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Information  Management  and 
Technology  Division 


B-246533.1 

February  19, 1992 

The  Honorable  John  Conyers,  Jr. 

Chairman,  Legislation  and 
National  Security  Subcommittee 
Committee  on  Government  Operations 
House  of  Representatives 

Dear  Mr.  Chairman: 

This  report  discusses  the  impact  of  including  or  excluding  integration  capabilities  for 
space-based  interceptors  into  the  missile  defense  system  architecture.  The  report  further 
discusses  the  need  for  solidifying  the  organization’s  system  architecture  and  the  significant 
technological  challenges  that  the  organization  must  overcome. 

As  arranged  with  your  office,  unless  you  publicly  announce  the  contents  earlier,  we  plan  no 
further  distribution  of  this  report  until  30  days  from  the  date  of  this  letter.  We  will  then  send 
copies  to  other  appropriate  congressional  committees;  the  Director,  Strategic  Defense  Initiative 
Organization;  the  Director,  Office  of  Management  and  Budget;  the  Secretary  of  Defense;  and 
other  interested  parties. 

This  report  was  prepared  under  the  direction  of  Samuel  W.  Bowlin,  Director  for  Defense  and 
Security  Information  Systems,  who  may  be  reached  at  (202)  336-6240.  Other  m^or  contributors 
are  listed  in  appendix  III. 


Sincerely  yours. 


Executive  Summary 


Purpose 


Background 


In  1983,  President  Reagan  launched  a  multibillion-dollar  program  to 
develop  a  system  for  protecting  America  against  ballistic  missile  attacks. 
Known  as  the  Strategic  Defense  Initiative  (sdi),  the  program  is  now 
nearing  the  end  of  its  first  decade  of  research  and  development.  During 
this  time,  with  billions  of  dollars  having  been  spent,  sdi  has  imdergone 
repeated  changes  in  its  objectives  and  design.  The  current  sdi  system  is 
intended  to  defend  against  a  limited  ballistic  missile  attack  from  any 
country  and  is  estimated  to  cost  $46  billion  (in  fiscal  year  1991  dollars).  In 
response  to  a  request  from  the  Chairman,  Legislation  and  National 
Security  Subcommittee,  House  Committee  on  Government  Operations, 
GAO  re\  ved  the  status,  challenges,  and  risks  associated  with  the 
Strategic  Defense  Initiative  Organization's  (sdio)  current  system  and  its 
automated  data  processing  and  communications  technologies. 


SDIO  has  changed  its  approach  to  ballistic  missile  defense  several  different 
times,  consuming  billions  of  dollars  along  the  way.  Program  objectives 
shifted  in  1987  from  defending  the  United  States  against  a  massive  Soviet 
attack  to  the  goal  of  deterring  such  an  attack.  In  1990,  the  introduction  of 
Brilliant  Pebbles,  a  new  space-based  interceptor  that  sdio  hoped  would 
increase  system  survivability  and  reduce  cost,  caused  sdio  to  change 
direction  again.  Because  of  this  constant  change,  gao  concluded  in  July 
1990  that  the  architecture  should  be  stabilized  before  proceeding  with 
system  development.  An  architecture  defines  the  system’s  functions  and 
the  relationships  among  components.  It  also  provides  a  road  map 
identifying  the  technologies  that  will  be  needed  to  complete  the  system. 

In  Januaiy  1991,  the  program’s  objectives  changed  once  more  as  President 
Bush  directed  that  sdi  provide  protection  from  limited  ballistic  missile 
attacks  originating  from  any  country  in  the  world.  This  change  came  about 
because  of  a  perceived  lessening  of  the  Soviet  threat  and  the  emergence  of 
tactical  ballistic  missile  threats  from  Third  World  countries  such  as  Iraq. 

To  meet  program  objectives,  sdio  is  advocating  an  integrated  system  that  i 

includes  both  ground-  and  space-based  interceptors.  This  system  is  known 
as  GPALS  — Global  Protection  Against  Limited  Strikes. 

1 

GPALS  has  three  segments,  two  ground-  and  one  space-based.  One  of  the 
ground-based  segmentsAvould  have  sensors  and  interceptors  to  protect 
U.S.  military  forces  overseas,  along  with  friends  and  allies,  from  missile 
attack.  Another  ground-ba^ed  segtnent  would  protect  the  United  States 
itself  from  accidental  or  limited  attacks  of  up  to  200  warheads.  The  third  : 

segment,  a  space-based  defense,  Would  help  detect  and  intercept  missiles 
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and  warheads  launched  from  anywhere  in  the  world.  According  to  sdio,  all 
three  segments  will  be  integrated  to  provide  mutual,  coordinated  support. 
This  approach  requires  that  all  segments  be  designed  to  work  together 
using  automated  data-processing  and  communications  networks. 

The  Missile  Defense  Act  of  1991,  which  establishes  a  national  goal  for 
missile  defense,  was  enacted  in  December  1991.  The  act’s  goal  is  to  deploy 
a  missile  defense  system  to  protect  the  United  States,  its  forward  deployed 
troops,  and  its  firiends  and  allies  against  limited  missile  attacks. 


Results  in  Brief 
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The  goal  of  the  Missile  Defense  Act  of  1991  includes  the  deployment  of 
both  national  and  theater  ground-based  defenses;  the  act  depicts 
space-based  interceptors  as  a  possible  ftiture  option.  However,  the  act 
does  not  address  whether  integration  capabilities  for  space-based 
interceptors  should  be  included  in  the  missile  defense  system  architecture. 

SDIO  is  continuing  to  design  gpals — whose  cornerstone  is  space-based 
interceptors.  According  to  the  Director  of  sdio,  integration  capabilities  for 
space-based  interceptors  are  being  included  in  the  missile  defense  system. 
Including  or  excluding  integration  capabilities  for  space-based 
interceptors  in  the  missile  defense  system  architecture  has  significant 
design  and  cost  implications,  but  to  what  degree  is  unknown.  If  integration 
capabilities  for  space-based  interceptors  are  included  in  the  missile 
defense  system  architecture  but  they  are  never  deployed,  then 
unnecessary  systemwide  costs  will  be  incurred.  On  the  other  hand,  if 
integration  capabilities  for  space-based  interceptors  are  not  included  but 
are  later  deemed  necessary,  costly  reengineering  will  be  required. 

To  proceed  with  a  system  that  uses  both  ground-  and  space-based 
interceptors,  sdio  must  overcome  tremendous  technical  challenges.  Such  a 
system  will  push  the  cutting  edge  of  technology,  sdio  must  rely  on  some 
technologies  that  are  as  yet  unproven,  and  learn  how  to  integrate  them 
into  a  reliable  system.  Designing,  developing,  and  deploying  a  system  with 
these  imcertainties  increases  the  risk  that  the  system  will  not  provide  the 
level  of  protection  sdio  currently  promises. 
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Principal  Findings 


Uncertainties  Could 
Adversely  Affect  System 
Design  and  Cost 


The  Missile  Defense  Act  of  1991  does  not  address  whether  integration 
capabilities  for  space-based  interceptors  should  be  included  in  the  missile 
defense  system  architecture.  However,  the  act  authorizes  $465  million  for 
research  and  development  on  space-based  interceptors  and  states  that 
they  could  support  some  future  system.  Defense  and  the  Director  of  sdio 
state  that  sdio  is  continuing  to  design  gpals;  integration  capabilities  for 
space-based  interceptors  are  being  included  in  the  missile  defense  system 
architecture.  Further,  they  state  the  system  will  be  ready  to  incorporate 
space-based  interceptors  if  national  decisionmakers  decide  to  include 
them. 


1 


Proceeding  with  an  architecture  with  or  without  integration  capabilities 
for  space-based  interceptors  raises  two  concerns.  First,  if  integration 
capabilities  for  space-based  interceptors  are  included  in  the  architecture 
but  they  are  never  deployed,  system  design  and  engineering  costs  may  be 
wasted.  Any  hardware,  software,  and  communications  capabilities 
included  in  the  other  subsystems  specifically  needed  for  interacting  with 
space-based  interceptors  would  be  superfluous.  Second,  if  such 
integration  capabilities  are  not  included  in  the  missile  defense  system 
architecture  but  space-based  interceptors  are  later  deemed  desirable, 
costly  redesign  or  reengineering  will  be  necessary  to  integrate  them  into 
the  existing  system.  For  example,  ground-based  subsystems  would  not 
have  been  designed  and  developed  with  the  hardware,  software,  and 
communications  capabilities  needed  to  interact  with  space-based 
interceptors.  To  preclude  costly  redesign  or  reengineering  and  to  ensure 
compatibility,  all  potential  segments,  subsystems,  and  their  respective 
integration  capabilities  need  to  be  included  in  the  architecture. 

Further,  sdio  has  introduced  additional  risk  into  opals'  design  and 
development,  sdio  has  distributed  integration  responsibilities  among 
different  contractore  without  identifying  the  exact  subsystems  to  be 
included  in  opals’  two  ground-based  segments.  Consequently,  the  risk  is 
increased  that  the  opals  subsystems  will  not  be  compatible.  Without  a 
well-defined  architecture  describing  how  and  which  subsystems  will  work 
together,  developers  may  interpret  their  integration  functions  incorrectly, 
which  increases  the  risk  of  subsystem  incompatibility.  Indeed,  officials  at 
two  Defense  organizations,  including  the  Army  Strategic  Defense 
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Command’s  Chief  of  the  Battle  Management  Division,  stated  that 
confusion  and  duplication  of  effort  could  already  be  occurring. 


Unprecedented  Technical  if  the  Congress  and  smo  decide  to  design,  develop,  and  deploy  a  space- 
Challenges  Increase  Risk  ground-based  system,  tremendous  technological  challenges  must  be 

overcome,  gpals  stretches  the  capabilities  of  today’s  technology.  For  the 
system  to  succeed,  significant  advances  must  be  made  over  the  next 
several  years  in  critical  areas,  such  as  software  engineering  and 
space-to-space  communications.  If  these  advances  are  not  achieved, 
schedule  delays,  escalating  costs,  and  performance  problems  could  occur. 

The  technical  complexity  of  integrating  gpals’  segments  and  subsystems  is 
unprecedented.  Its  functions  will  be  distributed  among  hundreds  of 
computers  located  in  space  and  throughout  the  world.  The  system  must 
operate  in  real  time,  in  a  hostile  environment,  and  with  a  dynamic 
configuration  of  sensors,  targets,  and  interceptors.  'The  communications 
and  data  processing  must  be  highly  reliable  and  secure.  Given  the  short 
time  to  react  to  an  attack — 35  minutes  for  an  intercontinental  missile  and 
far  less  for  a  tactical  one — critical  data  must  be  received,  analyzed,  and 
acted  on  almost  instantaneously.  And  because  processing  and 
communications  components  could  malfunction  or  be  destroyed  during 
battle,  the  links  among  subsystems  must  acconunodate  change.  The 
critical  hardware  and  software  technologies  needed  to  perform  these 
functions  are  in  various  stages  of  maturity;  some  are  already  being  used 
while  others  are  still  being  researched. 

Even  if  the  technologies  needed  become  available,  SDio  still  faces  the 
enormous  challenge  of  integrating  them  into  a  cohesive  system.  'This 
challenge  stems  not  only  from  inexperience  with  the  individual 
technologies  but  also  from  a  lack  of  knowledge  about  how  these  new 
technologies  will  interact. 


Recommendations  to 
the  Secretary  of 
Defense 


Because  of  the  design  and  cost  implications  of  including  or  excluding 
integration  capabilities  for  space-based  interceptors  in  the  missile  defense 
system,  gao  reconunends  that  the  Secretary  of  Defense  provide  the 
Congress  with  an  analysis  of  the  design  and  cost  implications  of 
(1)  including  integration  capabilities  for  space-based  interceptors  in  the 
architecture  but  never  deploying  them  and  (2)  excluding  such  integration 
capabilities  from  the  architecture  but  incorporating  space-based 
interceptors  later. 
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Agency  Comments 


Subsequently,  gao  reconunends  that  the  Secretary  of  Defense  develop  and 
submit  with  its  next  appropriation  request  an  implementation  plan  that 
(1)  clearly  lays  out  system  and  integration  architectures  and  (2)  describes 
technology  availability  schedules,  plans  for  inserting  demonstrated 
technologies,  and  contingencies  when  technologies  are  not  available  (see 
ch.  4). 


The  Department  of  Defense  generally  concurred  with  gao’s 
recommendation  to  the  Secretary  of  Defense  concerning  the  development 
of  an  implementation  plan  and  with  the  report’s  fmdings.  However,  it  did 
not  concur  with  gao’s  depiction  of  the  complexity  of  the  gpals  system  and 
the  immaturity  of  some  needed  critical  technologies.  Defense  did  not  offer 
convincing  evidence  to  dispute  the  facts  presented  in  the  draft  report. 
Additionally,  in  commenting  on  a  draft  of  this  report,  Defense  and  the 
Director  of  SDio  state  that  sdio  is  continuing  to  design  gpals  and  will 
include  integration  capabilities  for  space-based  interceptors  in  the  missile 
defense  system  described  in  the  Missile  Defervse  Act  of  1991.  Because 
including  or  excluding  such  integration  capabilities  will  have  a  significant 
impact  on  system  design  and  cost,  gao  redirected  the  draft  report's 
recommendation  from  the  Congress  to  the  Secretary  of  Defense. 
Specifically,  gao  now  recommends  that  the  Secretary  of  Defense  provide 
the  Congress  with  an  analysis  of  these  cost  and  design  implications.  See 
chapter  4  for  a  detailed  evaluation  of  Defense’s  comments. 
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Introduction 


Since  1984,  the  Department  of  Defense,  through  its  Strategic  Defense 
Initiative  Organization  (sdio),  has  received  about  $25  billion  for  research 
and  development  of  a  ballistic  missile  defense  system.  During  this  time  the 
program’s  objectives  and  the  system  being  designed  and  developed  have 
changed  several  times.  Currently,  sdio  would  like  to  deploy  a  system  to 
protect  the  United  States  from  ballistic  missile  attacks  of  up  to  200 
warheads,  and  to  protect  U.S.  forces  deployed  overseas  and  our  toends 
and  allies.  The  President’s  fiscal  year  1992  budget  estimates  this  system’s 
acquisition  cost  to  be  $46  billion  in  fiscal  year  1991  dollars. 


SDIO’s  Ballistic 
Missile  Defense 
Program 


On  March  23,  1983,  President  Reagan  called  for  a  comprehensive  scientific 
research  effort  to  develop  a  system  that  would  render  nuclear  ballistic 
missiles  impo'  ent  and  obsolete.  In  January  1984,  Defense  established  the 
Strategic  Defense  Initiative  (sDi)  as  a  research  and  technology 
development  program.  SDi’s  goal  was  to  provide  the  basis  for  an  informed 
decision  on  whether  to  develop  and  deploy  a  defense  system  to  shield  the 
United  States  against  a  massive  Soviet  ballistic  missile  attack.  In  April 
1984,  Defense  formally  chartered  sdio  as  the  agency  responsible  for 
managing  the  program. 


What  Is  Ballistic  Missile  in  1983,  President  Reagan  directed  that  an  intensive  analysis  be  conducted 

Defense?  identify  what  new  technologies  could  be  used  to  counter  a  ballistic 

missile  attack.  This  analysis  became  known  as  the  Fletcher  study.*  The 
study  contained  three  conclusions  that  affected  the  design  of  all  ballistic 
missile  defense  architectures. 

First,  it  concluded  that  an  elftctive  defense  system  must  be  designed  to 
intercept  ballistic  missiles  in  any  of  the  three  flight  phases — boost, 
midcourse,  and  terminal.  The  Fletcher  study’s  second  conclusion  was  that 
an  effective  architecture  would  include  both  ground-  and  space-based 
interceptors  and  sensors.  Third,  the  study  concluded  that  an  effective 
defense  system  would  have  only  three  basic  functions — sensing, 
interception  and  destruction,  and  battle  management/command,  control, 
and  communications  (bm/o). 

The  sensing  function  of  a  ballistic  missile  defense  system  would  be 
conducted  by  both  ground-  and  space-based  sensors,  whose  purpose 
would  be  to  determine  the  characteristics  of  an  attack — that  is,  to  locate 
the  ii’issiles  and  warheads,  discriminate  the  missiles  from  the  decoj^,  and 


'Eliminating  the  Threat  Pos<hI  by  Nviclrar  Ballistic  Mis-siles,  .lames  C.  Het<-her,  October  lf>83. 
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determine  where  the  missiles  are  going.  Once  the  sensors  collect  targeting 
information,  the  information  can  be  used  by  whatever  wejqjons  sj'stems 
are  available  to  intercept  and  destroy  the  targets.  Finally,  the  bm/C3  system, 
with  its  hardware,  software,  and  communications  links,  supports 
information  exchange,  coordinates  actions,  and  facilitates  human 
command  and  control.  To  date,  all  of  sdio’s  proposed  architectures  have 
been  based  on  the  Fletcher  study’s  layered  defense  concept  and  have 
incorporated  the  three  basic  functions  defined  in  the  study. 


Ballistic  Missile  Defense 
Objectives  and  System 
Design  Have  Undergone 
Significant  Change 


snio  has  refocused  its  program  several  times  to  accommodate  changing 
program  concepts  and  objectives,  emerging  technologies,  and  changes  in 
perceived  threat.  Tlie  initial  objective  in  1983  was  to  provide  the  basis  for 
an  informed  decision  on  whether  to  design,  develop,  and  deploy  a  system 
to  defeat  a  massive  Soviet  attack  on  the  United  States.  The  system  was  to 
include  space-and  ground-based  weapons  and  sensors,  including  exotic 
directed  energy  subsystems  such  as  lasers  and  particle  beams.  In  1987  the 
focus  shifted  from  defeating  a  Soviet  attack  to  a  less  ambitious  goal  of 
deterrence,  sdio  decided  to  develop  and  deploy  the  system  in  phases.  The 
objective  of  the  first  phase  (known  as  Phase  I)  was  to  defend  against  a 
certain  classified  percentage  of  incoming  warheads.  More  exotic  weapons 
and  sensors  would  be  developed  and  deployed  in  later  phases  to  provide  a 
more  complete  defense.  'Then,  in  January  1990,  the  inclusion  of  a  new 
space-based  interceptor — Brilliant  Pebbles — ^resulted  in  m^or  changes 
that  reduced,  changed,  or  eliminated  the  need  for  some  of  the  space-based 
subsystems  in  the  Phase  I  design.  In  January  1991,  another  msuor  change 
occurred  when  President  Bush  directed  the  program  to  shift  its  objective 
from  deterrence  to  protection  from  limited  ballistic  missile  strikes 
originating  anywhere  in  the  world.  This  change  came  about  because  of  a 
perceived  lessening  of  the  Soviet  threat  and  the  emergence  of  tactical 
ballistic  missile  threats  from  Third  World  countries  such  as  Iraq. 


SDIO’s  System 


In  response  to  the  President’s  direction,  sdio  has  proposed  the 
development  and  deployment  of  a  ballistic  missile  defense  system,  Global 
Protection  Against  Limited  Strikes  (gpals),  meant  to  protect  against  up  to 
200  warheads  of  any  range  originating  anywhere  in  the  world.  ’This  would 
include  accidental  or  limited  attacks  on  the  United  States  as  well  as 
attacks  on  U.S.  forces,  friends,  and  allies  overseas,  sdio  calls  for  gpals  to 
include  three  interoperable  segments — a  theater  missile  defense  segment, 
a  national  missile  defense  segment,  and  a  global  missile  defense  segment. 
Figure  1.1  depicts  the  three  gpals  segments. 
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Figure  1.1:  Three  Segments  of  GPALS 
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GPALS:  What  Is  It? 


GPALS;  An  Interdependent 
System-of-Systems 


While  the  precise  makeup  of  opals  has  not  yet  been  solidified,  it  currently 
calls  for  (1)  surveillance  satellites  and  sensors  for  detecting, 
discriminating,  and  tracking  missiles  and  warheads;  (2)  space-  and 
ground-based  interceptors  for  destroying  them;  and  (3)  a  sophisticated 
BM/C3  system  for  integrating  the  sensors  and  interceptors  into  a  working 
unit.  SDio  refers  to  the  separate  sensor  and  interceptor  subsystems  as 
elements.  See  appendix  I  for  a  description  of  candidate  elements  for  opals. 

The  elements  of  opals  are  to  be  configured  into  the  three  segments.  The 
theater  segment  is  being  designed  to  protect  U.S.  forces  deployed 
overseas,  as  well  as  our  firiends  and  allies,  against  tactical  ballistic  missile 
threats  such  as  those  experienced  in  the  Persian  Gulf.  The  elements  in  the 
theater  segment  will  include  transportable  ground-based  radars  and 
interceptors,  and  will  receive  early  launch  detection  and  missile  tracking 
information  from  space-based  sensors. 

The  national  segment  is  to  protect  the  United  States  against 
intercontinental  ballistic  missiles.  It  will  consist  of  ground-based  elements 
strategically  located  across  the  United  States.  Orbiting  surveillance 
satellites  (currently  called  Brilliant  Eyes)  are  to  detect  missiles  and 
warheads  early  in  their  flight  and  track  them  through  the  midcourse  phase. 
This  information  will  be  provided  to  space-  and  ground-based  interceptors 
to  assist  them  in  acquiring  and  intercepting  their  targets. 

The  global  missile  defense  segment  is  to  provide  defense  against  ballistic 
missiles  of  any  range  launched  from  anywhere  in  the  world.  It  wiU  consist 
of  a  combination  sensor  and  interceptor  element  (currently  called  Brilliant 
Pebbles),  hundreds  of  which  will  orbit  the  earth.  The  global,  space-based 
segment  will  augment  the  other  segments  by  providing  detection  and 
interception  capability  in  the  boost  and  midcourse  phases  of  flight,  thus 
providing  the  layered  defense  advocated  by  the  Fletcher  study.  All 
segments  will  rely  on  a  distributed  command  center  element  that  wUl 
perform  functions,  such  as  communications  and  data  processing,  and  will 
direct  the  use  of  sensors  and  interceptors  during  battle. 


As  shown  in  figure  1.2,  gpals  will  protect  against  ballistic  missiles 
launched  from  anywhere  in  the  world.  Accordingly,  the  diversity  of 
threats,  along  with  the  operational  environment,  creates  a  unique  and 
demanding  challenge.  First,  the  space-based  elements  will  have  to  almost 
immediately  detect  and  begin  tracking  missiles  launched  from  anywhere  in 
the  world,  and  intercept  and  destroy  some  of  them.  Short-  and 
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medium-range  (including  tactical)  missiles  will  have  to  be  intercepted 
either  during  the  brief  time  in  which  they  are  outside  the  earth’s 
atmosphere  or  after  reentry.  Long-range  (intercontinental)  missiles  that 
are  not  destroyed  will  release  warheads,  possibly  along  with  decoys 
intended  to  confuse  the  system.  At  this  point,  space-based  elements  will 
have  to  detect  which  targets  are  warheads  and  which  are  decoys,  and 
intercept  and  destroy  more  warheads.  Space-based  elements  will  continue 
tracking  the  surviving  missiles  and  warheads  and  provide  targeting 
information  to  the  ground-based  elements.  The  ground-based  elements 
then  have  to  detect,  track,  and  intercept  all  remaining  warheads  before 
they  hit  their  targets. 
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Figure  1 .2:  Integrated  GPALS  Defense  Scenario 
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To  accomplish  this  feat,  all  elements  must  be  tightly  coordinated,  and  the 
processing  and  transmission  of  data  must  occur  in  real  time,  opals  will 
have  less  than  35  minutes — ^the  flight  time  of  an  intercontinental  ballistic 
missile — to  intercept  and  destroy  such  missiles  and  warheads,  and  even 
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less  time  for  tactical  missiles.  Further,  the  system  might  have  to  operate 
amidst  nuclear  warheads  exploding  in  space  and  during  enemy  attempts  to 
disrupt  communications  and  computer  operations.  The  formidable  task  of 
integrating  and  coordinating  the  diverse  gpais  elements  falls  to  one  of 
GPALs’  systems — battle  management/command,  control,  and 
communications  (bm/C3). 


The  Importance  and 
Complexity  of  Battle 
Management/ 
Command,  Control, 
and  Communications 
(BM/C3) 


BM/C3  has  been  characterized  as  the  “long  pole  in  the  tent,”  “the  paramount 
strategic  defense  problem,”  and  “the  pivotal  element  of  the  Strategic 
Defense  System.  The  bm/C3  system  will  need  to  coordinate  and  manage 
the  diverse  elements  of  a  ballistic  missile  defense  system  by  quickly 
analyzing  sensor  data  and  directing  interceptors  to  destroy  incoming 
missiles.  The  functions  needed  to  do  this  include  (1)  automated  battle 
management  functions,  such  as  assigning  interceptors  to  targets;  (2) 
hmnan  command  and  control,  including  automated  decision  support;  and 
(3)  communications  among  the  system’s  elements.  A  detailed  blueprint  of 
BM/C3  functions,  including  the  required  technologies,  interfaces,  and 
location  of  the  functions,  is  referred  to  as  the  integration  or  bm/cs 
architecture.  This  architecture  serves  as  a  guide  for  implementing  the 
BM/C3  system. 


BM/C3  Integrates  GPALS  gpals  is  a  system-of-systems  in  that  the  three  segments,  as  well  as  the 
Into  a  System-of-Systems  elements  within  the  segments,  need  to  work  together.  Although  the 

segments  are  to  be  interdependent,  sdio  hopes  to  increase  system 
survivability  by  designing  gpals  so  that  each  segment  can  work 
independently  if  necessary,  sdio  is  also  attempting  to  design  the  elements 
within  segments  to  be  as  independent  as  possible,  gpals’  system 
performance  and  effectiveness,  however,  are  maximized  by  sensor  and 
interceptor  coordination  between,  among,  and  within  segments. 

Between  segments,  for  example,  early  warning  of  launches  and  accurate 
tracking  data  from  the  space-based  segment  could  enhance  the  theater 
segment’s  effectiveness  by  facilitating  earlier  intercepts  than  would  be 
possible  using  only  theater  elements.  Within  the  same  segment, 
communication  between  ground-based  sensors  and  interceptors  is 
necessary  for  updating  targeting  information  as  the  interceptor 
approaches  the  target.  SDio’s  mjyor  system  acquisition  policy  for  managing 
the  design,  development,  and  deployment  of  large  complex  systems 


^Fletcher  Study;  Summer  Study  198.5:  A  Report  to  the  Director,  Strategic  Defense  Initiative 
Organization,  Eastport  Study  Group,  Dr.  Danny  Cohen,  Study  Chairman,  December  l986. 
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National  Goal  for 
Ballistic  Missile 
Defense 


endorses  identifying  the  pieces  of  the  system  architecture  early  in  the 
design  process.  Because  of  the  kinds  of  interdependencies  discussed 
above,  it  is  very  important  that  all  system  segments  and  elements  be 
identified  early  so  ^at  the  bm/C3  architecture  can  be  defined. 

A  well-defined,  integrated  bm/C3  architecture  provides  a  blueprint  for 
developers  by  ensuring  that  interfaces,  interdependencies,  and  common 
functions  are  identified  and  used  to  design  and  develop  the  various  parts 
of  the  system.  Given  this  blueprint,  each  developer  understands  what  its 
role  is  and  how  its  work  fits  into  the  overall  system.  After  the  bm/C3 
architecture  has  been  solidified,  the  hardware  and  software  technologies 
needed  for  its  implementation  can  be  determined,  and  reasonable 
implementation  plans  and  schedules  can  be  formulated.  For  these  reasons, 
if  any  segment  or  element  is  added  later,  software  and  hardware  must  be 
at^usted  or  systems  replaced  to  accommodate  the  change.  This  rework  is 
known  as  reengineering  and  its  cost  is  a  function  of  the  significance  of  the 
change.  On  the  other  hand,  if  an  element  or  segment  is  planned  for  but  not 
deployed,  some  s^temwide  design  and  development  cost  will  be  wasted. 


This  past  December,  the  Missile  Defense  Act  of  1991,  which  for  the  first 
time  establishes  a  goal  for  missile  defense,  was  enacted.  The  act  directs 
the  Secretary  of  Defense  to  deploy  a  missile  defense  system  by  the 
mid-1990s.  Specifically,  the  act  states: 

(a)  MISSILE  DEFENSE  GOAL. — It  is  a  goal  of  the  United  States  to — 

(1)  deploy  an  anti-baUistic  missile  system,  including  one  or  an  adequate  additional  number 
of  anti-ballistic  missile  sites  and  space-based  sensors,  that  is  capable  of  providing  a  highly 
effective  defense  of  the  United  States  against  limited  attacks  of  ballistic  missiles; 

(2)  maintain  strategic  stability;  and 

(3)  provide  highly  effective  theater  missile  defenses  (TMDs)  to  forward-deployed  and 
expeditionary  elements  of  the  Armed  Forces  of  the  United  States  and  to  friends  and  allies 
of  the  United  States. 

Additionally,  the  act  accelerates  the  development  of  both  theater  and 
national  missile  defense  systems.  However,  despite  the  mid-1990s 
deployment  goal,  the  Missile  Defense  Act’s  conferees  agree  that  there  is  no 
commitment  to  procure  national  systems  or  components  for  deployment 
before  the  technology  for  these  systems  or  components  is  ready. 
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Prior  GAO  Report 
Highlights  Concern 
Over  Unstable 
Architecture 


In  July  1990,  we  reported  that  SDio’s  approach  for  building  a  missile 
defense  system,  then  known  as  Phase  I,  was  in  a  state  of  flux.^  This  was 
primarily  because  Brilliant  Pebbles,  a  new  space-based  interceptor,  was 
added  to  the  system  architecture  that  was  intended  to  increase  system 
survivability  and  reduce  cost.  Brilliant  Pebbles  significantly  changed  the 
Phase  I  design  and  highlighted  the  instability  of  sdio’s  approach  to  missile 
defense.  Iivstead  of  a  highly  integrated,  interdependent  architecture 
envisioned  for  Phase  I,  Brilliant  Pebbles  was  to  provide  more  autonomy 
and  require  less  interdependence  among  the  system's  other  sensors  and 
interceptors. 


'The  inclusion  of  Brilliant  Pebbles  rippled  across  the  entire  system  causing 
mqjor  restructuring  of  the  architecture.  Much  of  the  data  and  analyses 
conducted  on  the  previous  design  was  no  longer  relevant.  Surveillance, 
tracking,  and  communications  functions  and  responsibilities  had  to  be 
reallocated,  and  the  types  and  numbers  of  the  space-  and  ground-based 
sensors  and  interceptors  changed.  For  example,  by  introducing  Brilliant 
Pebbles,  two  space-based  sensors  and  a  space-based  weapon  have  been 
eliminated. 

'The  importance  of  a  stable  architecture  cannot  be  overstated.  An 
architecture  that  is  not  well-defined  runs  the  risk  that  system 
interdependencies  will  not  be  identified,  requirements  will  not  be  met,  and 
the  system  will  not  perform  as  intended.  We  cautioned  that  unless  the 
respective  elements  are  designed,  developed,  and  tested  as  an  integrated 
system,  significant  integration  problems  and  costs  could  emerge. 


Objectives,  Scope, 
and  Methodology 


The  Chairman,  Legislation  and  National  Security  Subcommittee,  House 
Committee  on  Government  Operations,  asked  that  we  review  sdio’s  plans 
for  developing  the  bm/c3  capabilities  needed  to  integrate  and  operate  opals. 
Specifically,  our  objectives  were  to  (1)  report  on  the  status  of  sdio’s 
ballistic  missUe  defense  system  and  bm/C3  architectures  and  (2)  identify  the 
automated  data  processing  and  communications  technology  challenges 
and  risks  for  designing  and  developing  opals’  bm/C3  capabilities. 


At  the  time  of  our  review,  the  program  was  undergoing  significant  change 
as  sdio’s  ballistic  missile  defense  objectives  moved  from  deterring  a 
massive  Soviet  attack  to  protecting  against  a  limited  attack  from  anywhere 
in  the  world,  sdio  is  currently  in  the  process  of  defining  its  opals  and  bm/C3 


^'Strategic  Defense  System:  Stable  Design  and  Adequate  Testing  Must  Precede  Decision  to  Deploy 
(OAOdMTE0-90-6I,July6, 1990). 
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architectures.  We  conducted  our  review  under  the  assumption  that  gpais, 
or  some  similar  variation,  would  be  SDio’s  ballistic  missile  defense  system. 

We  reviewed  and  analyzed  criteria  on  the  importance  of  a  well-defined 
BM/C3  architecture,  identified  and  determined  the  status  of  selected  bm/C3 
technologies,  and  interviewed  a  wide  range  of  officials  involved  in  the  SDi 
program.  To  imderstand  the  importance  of  bm/C3,  we  analyzed  cornerstone 
reports  such  as  the  Fletcher  study.  We  interviewed  and  obtained 
documentation  from  ballistic  missile  defense  experts,  including  officials 
from  the  Defense  Advanced  Research  Projects  Agency,  the  Army’s 
Strategic  Defense  Command,  and  the  Air  Force’s  Electronic  Systems 
Division. 

To  identify  and  determine  the  status  of  the  automated  data  processing  and 
communications  technologies  needed  for  gpals,  we  reviewed  smo’s 
Program  Management  Agreements,  which  specify  who  is  to  perform  what 
work  on  the  BM/C3  technologies.  Because  of  the  large  number  of 
technologies  needed  to  implement  the  bm/C3  for  gpals,  we  decided  to  focus 
primarily  on  selected  software  issues  and  on  parallel  computing,  sdio  has 
identified  six  engineering  areas:  algorithms,  software  engineering, 
networking,  communications,  security,  and  processors.  Software  applies 
to  all  engineering  areas  and  must  have  unprecedented  characteristics. 
'These  include  trust^  and  parallelism.^  To  quantify  the  relative  maturities  of 
trust  and  parallel  processing,  we  develop^  a  technology  matrix.  We  asked 
experts  from  the  Defense  Advanced  Research  Projects  Agency,  the 
National  Security  Agency,  the  Army  Strategic  Defense  Command,  and  the 
National  Institute  of  Standards  and  Technology  to  complete  the  matrix, 
applying  the  National  Aeronautics  and  Space  Administration’s  Maturity 
Index,  and  interviewed  these  officials  to  ensure  our  understanding  of  their 
responses. 

Further,  we  reviewed  and  analyzed  key  documentation  on  trusted  systems, 
parallel  processing,  and  software  engineering.  These  included  the  National 
Security  Agency’s  Rainbow  Series  on  trusted  computing  bases,  the 
Institute  for  Defense  Analyses’  report  on  software  research  and 
development  for  sdi,  Defense’s  1991  Critical  Technologies  Plan,  and  the 


^As  presented  in  Defense’s  standard  Department  of  DefenseTrusted  Computer  System  iX^uation 
Criteria,  trust  technology  is  the  systematic  application  of  computer  science  and  engineering  to  the 
protection  of  information  in  automated  systems. 

“Parallel  computing  involves  two  or  more  processors  working  together  to  solve  a  problem;  serial 
computing  uses  a  single  processor  to  solve  a  problem.  Software  for  parallel  processing  has  different 
characteristics  from  software  for  serial  processors. 
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Software  EIngineering  Institute’s  Maturity  Assessment  Model  for  software 
development 

We  interviewed  officials  involved  in  the  Strategic  Defense  Initiative 
program,  including  (1)  the  system  architect,  (2)  project  integrators  and 
engineers,  (3)  system  integration  and  command  and  control  officials,  and 
(4)  architecture  integration  study  officials.  We  also  met  with  Army  and  Air 
Force  officials  involved  in  ballistic  missile  defense  research  and 
development  programs.  Additionally,  in  concert  with  our  Office  of  General 
Counsel,  we  obtained  and  analyzed  relevant  documentation  on  the  Missile 
Defense  Act  of  1991. 

Our  work  was  conducted  from  September  1990  through  February  1992  at 
SDio  Headquarters,  Washington  D.C.;  Electronic  Systems  Division,  Boston, 
Massachusetts;  and  the  Army  Strategic  Defense  Command,  Huntsville, 
Alabama.  We  conducted  our  review  in  accordance  with  generally  accepted 
government  auditing  standards. 
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Eight  years  and  $25  billion  into  the  SDi  program,  the  Missile  Defense  Act  of 
1991  establishes  the  goal  of  deploying  a  highly  effective  missile  defense 
system.  The  goal  of  tlie  act  includes  the  deployment  of  both  national  and 
theater  ground-based  defenses;  space-based  interceptors  are  characterized 
as  a  potential  future  option.  However,  the  act  does  not  address  whether 
integration  (bm/C3)  capabilities  for  space-based  interceptors  should  be 
included  in  the  missile  defense  architecture. 

For  the  past  year,  sdio  has  been  pressing  forward  with  a  $46  billion 
system —  opals — ^to  address  the  change  in  program  focus  from  deterrence 
to  protection.  However,  the  opals  architecture  has  not  been  solidified. 
Without  a  stable  system  and  BM/C3  architecture  that  describes  the  segments 
and  elements  and  how  they  will  work  together,  the  risk  increases  that  the 
system  will  not  work  as  intended.  Every  time  the  system  architecture  is 
changed,  bm/cs  is  significantly  affected. 


Including  or 
Excluding 
Space-Based 
Interceptors  Has 
Significant  Design 
Cost  Implications 


Significant  design  and  cost  implications  could  emerge  if  integration 
capabilities  for  space-based  interceptors  are  included  or  excluded  in  the 
missile  defense  system  described  in  the  Missile  Defense  Act  of  1991.  The 
goal  of  the  act  includes  deploying  highly  effective  missile  defense  systems 
to  defend  the  United  States,  U.S.  forces  deployed  overseas,  and  our  friends 
and  allies  from  limited  missile  attacks.  The  act  characterizes  space-based 
and  interceptors  as  a  promising  technology  and  authorizes  $465  million  for 

their  continued  research  and  development  in  fiscal  year  1992.  Further,  the 
act  states  that  space-based  interceptors  could  be  a  future  option  to 
support  ground-based  defenses.  However,  the  act  does  not  address 
whether  integration  capabilities  for  space-based  interceptors  should  be 
included  in  the  missile  defense  system  described  in  the  act. 


SDio  is  continuing  to  design  gpais — whose  cornerstone  is  space-based 
interceptors.  According  to  its  director,  sdio  is  including  integration 
capabilities  in  its  missile  defense  system,  and  the  system  will  be  ready  to 
support  all  segments  whenever  they  are  incorporated  into  the 
architecture.  Including  or  excluding  integration  capabilities  in  the  missile 
defense  architecture  for  meeting  the  goal  of  the  act  raises  two  concerns 
from  a  system-of-systems  perspective. 

First,  if  integration  capabilities  for  space-based  interceptors  are  included 
in  the  missile  defense  architecture  but  they  are  never  deployed,  then 
design  and  development  costs  for  including  space-based  interceptors  will 
have  been  wasted.  Any  hardware,  software,  and  communications 
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capabilities  included  in  the  system’s  other  elements  which  would  facilitate 
integration  specifically  with  Brilliant  Pebbles  would  be  superfluous.  For 
example,  the  space-based  sensors’  battle  management,  command  and 
control,  and  communications  software  would  have  been  written  to  provide 
launch  and  targeting  information  to  Brilliant  Pebbles.  Additionally,  the 
space-based  sensors’  hardware,  (e.g.,  computers  and  antennae)  would 
have  been  designed  to  support  the  additional  requirements  placed  on  them 
by  Brilliant  Pebbles. 

Second,  if  integration  capabilities  for  space-based  interceptors  are  not 
included  in  the  elements  of  the  missile  defense  system  architecture,  and  an 
exclusively  ground-based  missile  defense  system  is  deployed,  but  the 
space-based  interceptors  are  later  deemed  desirable,  then  costly  redesign 
or  reengineering  will  be  required. 

Under  this  second  scenario,  the  national  and  theater  segments  would  have 
been  designed,  engineered,  and  deployed  without  the  hardware,  software, 
and  communications  capabilities  needed  to  integrate  specificaUy  with 
Brilliant  Pebbles.  For  example,  space-based  sensors,  costing  billions  of 
dollars,  would  have  been  built  to  process  and  send  sensing,  tracking,  and 
targeting  information  to  ground-based  interceptors  only.  likewise,  the 
groimd-based  interceptors  would  have  computers  and  communications 
links  designed  and  built  to  receive  and  handle  information  from  the 
space-based  sensors  included  in  the  architecture — not  from  Brilliant 
Pebbles  or  some  other  space-based  interceptor.  Consequently,  the 
ground-based  system’s  hardware  and  software  would  have  to  be 
redesigned  or  reengineered  to  handle  increased  processing  and 
communications  requirements. 

In  January  1991,  when  the  President  changed  the  focus  firom  deterrence  to 
protection,  SDio  was  faced  with  the  enormous  task  of  reassessing  its 
system  and  bm/C3  architectures.  As  a  result,  in  February  1991,  SDio  initiated 
a  multi-million  dollar  architecture  integration  study  to  address  program 
changes  and  to  guide  opals  and  bm/c3  design  and  development.  According 
to  the  statement  of  work,  the  objective  of  the  study  is  to  define  a  system 
architecture  for  opals  that  could  evolve  from  an  initial  theater  missile 
defense  system  to  a  full  opals  system,  and  possibly  beyond  to  a  system 
capable  of  thwarting  a  massive  attack.  The  study  is  to  look  at  the  time 
phasing  of  opals,  taking  into  consideration  the  availability  of  technology 
and  affordability.  It  is  also  to  completely  describe  the  bm/C3  system; 
analyze  trade-offs  among  the  system’s  elements  in  terms  of  performance, 


Changes  in 
Architecture 
Significantly  Hinder 
BM/C3  Development 
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cost,  schedule,  and  risk;  and  describe  how  gpals  and  its  elements  will 
function.  Additionally,  the  study  is  to  provide  enough  detail  to  guide 
element  design,  prioritize  the  technologies  needed  to  field  the  system,  and 
determine  when  the  technologies  are  needed. 

The  study  has  not  been  completed.  According  to  the  study  director,  the 
study  group  is  still  considering  many  different  sensor  and  interceptor 
combinations  for  gpals;  exactly  which  elements  will  comprise  gpals  has 
not  been  decided.  Until  SDio  at  least  identifies  the  pieces  of  gpals  and  their 
fimctions  with  some  degree  of  certainty,  it  is  unclear  how  a  bm/C3 
architecture  can  be  defined,  thus  making  it  impossible  to  provide  the  bm/C3 
developers  the  guidance  they  need. 

Even  though  the  system  and  bm/C3  architectures  have  not  been  solidified, 
SDio  has  distributed  bm/C3  research  and  development.  However,  without  a 
clear  understanding  of  bm/c3  responsibilities,  the  risk  increases  that  bm/cs 
development  may  not  be  relevant,  or  elements  will  be  incompatible  and 
thus  unable  to  operate  as  a  single  working  unit  Officials  at  two  Defense 
organizations,  the  Army  Strategic  Defense  Conunand  and  the  Air  Force 
EUectronic  Systems  Division,  have  expressed  concern  over  the  extensive 
distribution  of  bma3  research  and  development  without  a  well-defined 
architecture. 

Army  Strategic  Defense  Command  officials,  including  the  Chief  of  the 
Battle  Management  Division,  believe  that  the  large  number  of  BM/C3 
developers  will  ultimately  result  in  greater  cost  and  complexity, 
duplication  of  effort,  increased  schedule  risk,  interface  problems,  and 
poor  performance.  Furthermore,  they  contend  that  numerous  developers 
and  decentralized  bm/C3  development  responsibilities  increase  the 
complexity  of  the  program  and  its  management.  These  Army  officials 
conclude  that  the  least  understood  and  potentially  most  difficult  piece  of  a 
ballistic  missile  defense  system  — BM/C3  design  and  development — is 
being  fragmented  and  complicated.  They  strongly  recommend  a  single 
BM/C3  architecture  and  one  technical  authority  that  has  responsibility  for 
integration.  Air  Force  officials  at  the  Electronic  Systems  Division  share 
these  concerns. 

Several  examples  show  how  an  unstable  architecture  is  causing  confusion 
and  duplication  of  effort.  Air  Force  officials  responsible  for  the  Command 
Center  element  stated  that  they  have  no  idea  what  technologies  will  be 
required  because  SDio  has  not  defined  the  bm/C3  architecture.  Air  Force 
officials  haul  developed  a  series  of  tests  for  analyzing  ballistic  missile 
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attack  response  options  and  question  why  sdio’s  integration  contractor  has 
similar  tests.  Further,  according  to  Army  officials,  including  the 
Technologies  Section  Chief,  Battle  Mangement  Division,  SDio  has  not 
funded  fault-tolerance  technology  research  for  the  Strategic  Defense 
Command  because  fault  tolerance  was  being  researched  under  sdio’s 
trusted  software  effort.  However,  the  National  Security  Agency  (nsa) 
official  responsible  for  sdio’s  trusted  software  activity  sees  fault  tolerance 
as  a  hardware  issue,  and  did  not  consider  fault  tolerance  in  his  definition 
of  trust.  'These  same  Army  officials  asked  a  contractor  to  conduct  a  bm/c3 
function  analysis  because  sdio’s  integration  contractor  had  not  completed 
the  same  type  of  analysis.  However,  the  Architecture  Integration  Study 
statement  of  work  indicates  that  study  contractors  are  also  performing 
this  analysis. 
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If  a  decision  is  made  to  design,  develop,  and  deploy  a  global, 
multi-segment  system  such  as  gpals,  significant  technological  challenges 
must  first  be  overcome,  sdio  believes  these  technology  challenges  are  not 
insurmountable  and,  therefore,  would  like  to  continue  to  design  and 
develop  gpals.  However,  counting  on  technologies  that  are  currently  not 
proven  or  available  can  result  in  schedule  delays,  increased  cost,  or  poor 
system  performance. 


BM/C3  System  Is  gpals’  bm/C3  system  will  be  one  of  unprecedented  complexity.  Although 

Extraordinarily  Complex  ^  make  the  elements  and  segments  as  independent  as 

possible,  the  bm/cs  fimctions  must  be  distributed  among  hundreds  of 
computers  located  in  space  and  throughout  the  world.  Some  wiD  probably 
require  advanced  parallel  processing  designs.  To  solve  complex  problems, 
some  processors  may  require  information  from  multiple  data  bases.  This 
introduces  the  need  for  distributed  data  base  management  'The  computers 
and  their  associated  data  bases  vdll  be  linked  by  a  complex 
conununications  network  consisting  of  telephone  lines,  satellite  links, 
fiber  optics,  and  microwave  media.  Algorithms  (detailed  descriptions  of 
solutions  to  problems)  will  be  needed  to  perform  gpals’  automated 
functions,  including  sensor  and  interceptor  operations,  communications 
network  management,  and  battle  management. 

Other  complicating  factors  include  real-time  operation  in  a  hostile 
environment  and  a  dynamic  system  configuration.  The  flight  of  an 
intercontinental  ballistic  missile  would  last  only  about  35  minutes,  and  the 
flight  of  a  tactical  ballistic  missile  only  several  minutes.  During  this  time, 
the  BM/C3  system  will  have  to  direct  and  coordinate  the  detection,  tracking, 
interception,  and  destruction  of  up  to  200  warheads  with  sufficient 
accuracy  to  preclude  any  of  them  from  reaching  their  targets.  Additionally, 
critical  information  will  have  to  be  processed  and  shared  among 
many — possibly  hundreds — of  different  computers  operating  in  a  changing 
configuration.  'The  system  configuration  will  be  changing  because  system 
elements,  such  as  satellites  and  interceptors,  will  be  in  constant  motion. 
Those  destroyed  in  batUe  or  failing  to  function  as  intended  will  necessitate 
a  reconfiguration  of  the  communications  network. 

In  response  to  the  challenges  discussed  above,  sdio  has  identified  critical 
advances  in  software  and  hardware  technology  required  to  implement  a 
BM/C3  system.  Some  of  the  more  challenging  technology  requirements  are 
the  capability  to  build  trusted  software,  software  for  parallel  processors, 
tools  and  techniques  for  effective  software  engineering,  space-to-space 
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communications,  and  parallel  processing  for  ballistic  missile  defense. 
These  technologies  are  all  being  researched;  none  is  sufficiently  mature  to 
support  GPAts’  BM/C3  system. 


Successful  BM/C3 
Development 
Requires  Significant 
Software  Advances 


The  BM/C3  software  for  opals  will  be  the  most  complex  and  difficult  of  any 
military  or  civilian  software  developed  and  implemented  to  date.  Much  of 
the  critical  BM/C3  software  will  require  a  level  of  trust  never  before 
achieved.  It  may  have  to  operate  on  parallel  processors,  and  it  will  require 
a  highly  sophisticated  software  engineering  and  development  envirorunent 
that  is  not  currently  available.  Compounding  these  challenges  is  that  the 
state-of-the-practice  for  any  technology,  including  those  for  software, 
generally  lags  well  behind  the  technology’s  state-of-the-art.  In  other  words, 
researchers  may  understand  the  vmderlying  principles  for  a  technology; 
however,  it  will  be  some  time  before  the  technology  is  proven  well  enough 
to  be  commercially  available. 


Trust  for  GPALS  Software  According  to  senior  SDio  officials,  to  help  minimize  bma:^  development  risk. 
Currently  Undefined  software  must  be  trusted  when  necessary.  However,  trust  technologies  are 

the  most  inunature  of  all  the  technologies  needed  for  opals’  bm/c3.  The 
traditional  definition  of  trust  involves  information  security.  According  to 
officials  at  the  National  Security  Agency  (nsa).  Defense’s  executive  agent 
for  developing  information  security  standards,  trust  includes  data 
confidentiality,  integrity,  and  availability.  Data  confidentiality  means  that 
only  authorized  access  to  data  will  be  possible;  integrity  means  that 
information  is  protected  from  unauthorized  modification  or  destruction; 
and  availability  means  that  system  access  for  authorized  users  is  ensured, 
i.e.,  that  the  system  carmot  be  rendered  ineffective  by  malicious  attacks. 
Tliese  three  components  all  deal  with  thwarting  unauthorized  and 
malicious  attempts  to  access  or  destroy  the  information.  Confidentiality  in 
an  information  system  is  the  best  understood  of  the  three,  but  is  not  yet  a 
solved  problem.  Technologies  to  ensure  integrity  and  availability  are  just 
now  emerging. 

Yet  BM/C3  software  for  opals  requires  more.  In  addition  to  the  traditional 
definitions  of  confidentiality  and  integrity,  bm/C3  software  must  be  highly 
reliable  or  correct.  This  means  that  the  software  will  do  only  what  it  is 
supposed  to  do  and  nothing  else.  'The  implications  for  human  safety, 
national  defense,  and  international  relations  are  too  significant  to  risk 
incorrect  software.  Further,  bm/C3  software  must  support  system 
availability,  e.g.,  be  fault-tolerant.  A  fault-tolerant  system  provides 
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continuing  processing  capability  in  the  event  of  software  or  hardware 
failure  or  degradation.  Engineering  tools  and  approaches  for  ensuring 
confidentiality,  integrity,  availability,  and  correctness  in  large  complex 
software  are  in  various  stages  of  development 

NSA  is  managing  the  Trusted  Software  Program,  which  SDio  has  established 
to  address  trust  for  gpals’  software,  nsa  offtcials  are  defining  what  trust 
means  to  sdi,  developing  criteria  for  evaluating  trust  in  bm/C3  components 
(such  as  data  bases,  networks,  and  system  and  application  software),  and 
identifying  the  technologies  needed  to  implement  trust.  Consequently,  the 
policies,  guidance,  and  understanding  of  the  implications  of  building  and 
fielding  trusted  software  for  gpals  are  only  recently  becoming  known. 
Further,  some  trust  technologies  needed  to  implement  gpais  are  either  in 
their  infancy,  or  have  yet  to  be  proven  in  an  operational  environment. 

For  example,  a  trusted  distributed  operating  system  for  scheduling  parallel 
and  distributed  processing  is  currently  being  researched.  However, 
according  to  its  developer,  it  will  be  at  least  2  to  3  years  before  it  is 
commercially  available  and  accepted  by  nsa.  It  is  also  unclear  whether  the 
operating  system  will  be  able  to  handle  real-time  processing.  Trust  in  data 
base  management  systems  is  also  extremely  important.  Without  correct 
and  available  data,  operational  errors  could  occur  and  the  system  could 
experience  catastrophic  failure.  However,  sdio  and  nsa  have  only  just 
begun  to  address  the  question  of  what  is  required  for  gpals’  trusted  data 
base  management  systems.  Finally,  some  of  the  technologies  for  trusted 
applications  software  are  in  their  infancy.  For  example,  mathematical 
models  for  formally  verifjing  the  integrity  of  applications  software  are  just 
emerging.  Without  trust  and  the  models  to  verify  the  correctness  of 
software,  there  are  no  assurances  that  the  system  will  do  only  what  it  is 
supposed  to  do,  and  be  protected  from  unauthorized  access. 


Tools  for  and  Experience  Although  sdio  officials  differ  on  whether  gpals  will  require  parallel 
in  Parallel  Processing  Are  processors  (yet  another  indication  of  the  immaturity  of  this  program). 
Limited  many  experts  believe  that  gpals  cannot  achieve  the  performance  required, 

at  a  manageable  cost  and  with  room  for  growth,  without  using  parallel 
processors  for  some  bm/C3  functions.  To  effectively  use  parallel  processing, 
compatible  computer  languages,  compilers,  and  operating  systems  must 
be  used.  However,  some  of  the  required  parallel  technologies  are  either 
still  in  research  or  in  limited  use  in  environments  that  are  much  simpler 
than  that  in  which  gpai.s  must  operate. 
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BM/C3  Software 
Dependent  on  Immature 
Software  Engineering 
Environment 


SDio  has  been  researching  how  existing  battie  management,  message 
routing,  and  other  algorithms  specifically  written  for  serial  machines  can 
be  reused  in  a  parallel  processing  environment.  However,  SDio  researchers 
have  found  it  extremely  difficult  to  translate  structured,  sequential  serial 
code  into  parallel  code  that  can  perform  the  task  or  tasks  on  a  number  of 
processors.  If  serial  code  cannot  be  reused,  new  parallel  code  must  be 
created.  This  will  present  SDio  with  a  m3jor  challenge.  First,  there  are  few 
engineers  with  experience  developing  parallel  code,  none  of  it  as  complex 
as  BM/C3  software.  An  entire  generation  of  software  engineers  has  been 
designing,  developing,  testing,  and  maintaining  serial-based  software, 
again  none  of  it  as  complex  as  that  required  for  opals,  and  have  found  the 
transition  to  a  parallel  environment  very  difficult.  Second,  computer-aided 
software  engineering  tools  (programs  that  assist  engineers  in  software 
requirements-setting,  design,  development,  and  testing)  for  parallel 
processing  are  just  emerging. 


Software  engineering  could  be  the  most  challenging  and  critical  bm/C3 
technology  issue.  According  to  the  Software  Engineering  Institute,  ‘  “the 
quality  of  a  software  system  is  governed  by  the  quality  of  the  process  used 
to  develop  and  evolve  it.”  In  1989  the  Institute,  using  a  maturity 
assessment  model  it  developed,  reported  that  86  percent  of  Defense 
software  developers  it  assessed  were  at  the  initial,  or  “ad  hoc  and  chaotic,” 
level  in  terms  of  process  maturity.  Specifically,  most  of  the  developers  did 
not  have  a  standard  software  development  process. 

The  production  and  integration  of  a  large  amount  of  high-quality,  reliable 
software  is  critical  to  the  success  of  the  gpals  mission.  The  bm/C3  software 
will  consist  of  millions  of  lines  of  code  developed  by  scores  of  contractors. 
Further,  the  software  must  include  trusted  characteristics  that  have  never 
been  accomplished  before  and,  most  likely,  will  have  to  be  developed  for 
parallel  processors.  For  these  reasons  a  comprehensive,  software 
engineering  environment  is  imperative  to  ensure  the  efficient 
development,  production,  integration,  and  validation  of  trusted  gpals 
software.  To  address  this  challenge,  sdio  has  tasked  the  Institute  for 
Defense  Analyses^  to  help  apply  the  Software  Engineering  Institute’s 
maturity  model  to  all  software  developers  and  is  developing  a  software 


'The  Software  Engineering  Institute  at  Pittsburgh’s  Camegie-Mellon  University  is  a  federally  funded 
research  and  development  center  sponsored  by  Defense  to  provide  leadership  in  advancing  the  state  of 
the  practice  of  software  engineering  to  improve  the  quality  of  systems  that  depend  on  software. 

*rhe  Institute  for  itefense  Analyses  is  a  federally  funded  research  and  development  center  that 
provides  technical  evaluations,  analyses,  and  support  to  U.S.  government  agencies. 
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Critical  BM/C3 
Hardware  Still  a 
Challenge 


engineering  environment  called  the  Strategic  Defense  Development 
System  (sdds). 

According  to  sdio  officials,  sdds  is  to  provide  a  comprehensive  software 
engineering  environment,  sdds  is  supposed  to  be  available  by  the 
mid-1990s  to  support  opals’  software  development.  It  will  provide  sdio 
contractors  with  a  common  software  engineering  environment  for 
developing,  testing,  and  integrating  software  code.  While  contractors  will 
be  encouraged  to  use  sdds,  they  will  be  allowed  to  use  whatever  specific 
tools  they  choose,  sdds  is  also  to  be  used  for  the  larger  task  of  integrating 
all  the  software  developed  by  the  various  contractors,  sdds  is  to  provide  a 
central  data  base  for  storing  developed  software,  to  ensure  consistency 
and  completeness  in  the  requirements-setting  process,  and  to  assist  in 
implementing  trusted  software  characteristics,  sdio  plans  to  have  a  first 
version  of  sdds  available  for  release  early  in  1993;  however,  according  to 
the  program  mani^er  for  software  engineering,  it  will  only  have 
rudimentaiy  capabilities.  Further,  sdds  may  have  to  use  a  highly 
sophisticated  data  base  that  is  still  being  researched. 


Generally  speaking,  hardware  technologies  appear  to  be  advancing  fairly 
r^idly.  Most  challenges  involve  using  the  technology,  rather  than 
understanding  the  underlying  principles  of  it.  Two  examples  are 
(1)  space-to-space  communications  and  (2)  parallel  processors  for  ballistic 
missile  defense. 

The  conununications  links  needed  among  the  space-based  elements  of  a 
ballistic  missile  defense  system  have  always  presented  a  formidable 
challenge  to  Defense,  sdio  is  currently  assessing  whether  opals  will  require 
extremely  high  radio  frequency  communications,  laser  communications, 
or  both,  to  meet  space-to-space  communications  needs.  While  extremely 
high  radio  frequencies  and  laser  communications  for  space-to-space 
cross-links  are  still  not  available,  the  basic  technologies  are  proven.  The 
difficulty  is  not  so  much  in  understanding  the  basic  technological 
principles  as  in  implementing  them  in  space  on  board  small,  lightweight 
satellites.  For  such  space  applications,  some  of  the  engineering  challenges 
include  developing  reliable,  lightweight  components®  with  low  power 
requirements,  and  ensuring  that  satellites  can  accurately  exchange 
necessary  information  among  other  continually  moving  satellites. 


X^omponents  are  all  of  the  parts  that  make  up  the  satellites  including  processors,  power  sources, 
antennae,  propulsion  systems,  etc. 
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Parallel  processing  hardware  has  been  available  for  years;  however,  the 
tools  and  experience  for  developing  complex  parallel  software  have  lagged 
behind.  Parallel  processing  can  help  meet  Defense’s  real-time  processing 
requirements  by  using  several  interconnected  processors  to  work  on  a 
task,  or  many  tasks,  simultaneously.  Parallel  processors  are  highly 
desirable  because  of  their  capability  to  handle  enormous  amounts  of  data 
simultaneously,  their  capability  for  increased  capacity,  their  decreasing 
costs,  and  because  of  the  projected  physical  limitations  of  serial 
processors.  For  these  reasons,  differing  and  competing  design 
philosophies  have  recently  emerged,  and  many  different  models  and  types 
are  now  commercially  available.  However,  implementing  parallel 
processors  on  board  small,  lightweight  spacecraft  will  be  difGcult  because 
of  size,  weight,  and  power  constraints,  sdio  has  conducted  and  plans  to 
continue  conducting  tests  intended  to  demonstrate  this  capability. 


Individual  technologies  alone  cannot  support  opals  bm/C3.  If  and  when 
each  technology  is  proven,  sdio  will  be  faced  with  the  enormous  challenge 
of  integrating  them  to  provide  the  data  processing  and  communications 
capabilities  needed.  For  simpler  systems  such  as  the  North  American 
Aerospace  Defense  Command’s  (norad)  Tactical  Warning  and  Attack 
Assessment  System  at  Cheyenne  Mountain,  Colorado,  integrating 
subsystems  is  a  technically  demanding  endeavor.'*  In  the  case  of  bm/C3,  the 
difficulty  lies  not  only  in  the  integration  task  itself,  but  also  in  the  lack  of 
experience  with  individual  technologies,  compounded  by  a  lack  of 
knowledge  of  the  interactions  among  them.  For  example,  there  is  no  real 
understanding  of  what  it  means  to  build  software  that  is  simultaneously 
trusted,  correct,  and  fault-tolerant;  trusted  components  for  real-time 
parallel  processors  are  an  object  of  ongoing  research;  technologies  for 
formally  verifying  large-scale  serial  software  are  still  unsophisticated 
despite  years  of  research;  and  technologies  for  formally  verifying  parallel 
software  are  only  now  being  addressed. 

Besides  the  complexify  of  the  interactions  among  the  various 
technologies,  trade-offs  must  also  be  made.  For  example,  building  trusted 
systems  may  mean  sacrificing  system  performance.  This  degradation  in 
performance  results  from  the  checks  the  system  must  perform  before 
allowing  access  to  the  processor,  data  base,  or  network,  sdio  and  nsa  are 
determining  what  effect  implementing  undefined  trusted  concepts  could 
have  on  system  performance. 

^Attack  Warning:  Better  Management  Rcquirc*d  to  Resolve  NORAD  Integration  Deficiencies 


Integration  of 
Immature 
Technologies 
Required  for  BM/C3 
Greatly  Exacerbates 
Existing  Complexities 
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Resolving  BM/C3  Technology  Challenges  Is 
Essential  to  Successful  GPALS  Development 


Correct  Selection  of 
BM/C3  Technologies 
Is  Critical 


Prematurely  committing  to  inadequate  existing  technologies,  or  depending 
on  the  future  success  of  immature  or  unavailable  technologies,  increases 
the  risk  that  gpais  will  not  work  as  intended,  or  will  not  be  able  to  easily 
evolve.  For  example,  if  SDio  decides  to  use  only  serial  processors  in  its 
BM/C3  architecture,  but  additional  requirements  are  levied  on  opals  that 
necessitate  high  performance  parallel  processing,  potentiaUy  millions  of 
lines  of  computer  code  would  have  to  be  reengineered.  Reengineering  this 
code  from  serial  to  parallel  applications  would  be  difficult  and  costly. 
Equally  dangerous  is  counting  on  technologies  that  may  not  be  available, 
may  not  perform  as  required,  or  may  not  be  sufficiently  reliable. 

A  technology  road  map  that  defines  what  technologies  are  needed  and 
when,  and  what  the  interdependencies  are,  is  essential.  Also  important  are 
plans  for  transitioning  from  existing  to  emerging  technologies,  plans  for 
inserting  technologies  as  they  become  available,  and  plans  for 
contingencies  if  a  technology  is  not  ready  when  needed. 
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The  Missile  Defense  Act  of  1991  establishes  for  the  first  time  a  national 
goal  of  deploying  highly  effective  missile  defenses  in  the  mid-1990s.  The 
act  is  the  culmination  of  years  of  debate  and  the  billions  of  dollars  spent 
on  various  baiiistic  missile  defense  system  proposals.  Approximately  one 
year  prior  to  the  act,  sdio  proposed  its  opals  approach  to  missile  defense 
and  is  ciurently  proceeding  with  its  design  and  development. 

Each  segment  of  opals,  in  and  of  itself,  is  highly  complex;  integrating  these 
segments  would  be  one  of  the  most  technologically  complex  undertakings 
the  nation  has  ever  faced.  A  decision  to  include  or  exclude  the  integration 
capabilities  for  space-based  interceptors  in  the  system  architecture  will 
have  significant  design  and  cost  implications,  although  the  extent  is  not 
known.  Identifying  which  sensors  and  interceptors  will  be  integrated  is 
vety  important  so  that  interactions,  such  as  what  data  needs  to  be  shared 
among  them,  can  be  planned  and  included  in  the  subsystem  designs. 
Without  a  stable  system  and  bm/C3  architecture  that  describes  the 
subsystems  and  how  they  will  work  together,  the  risk  increases  that  the 
system  MdU  not  work.  Furthermore,  msOor  shifts  in  the  architecture  (such 
as  including  or  excluding  integration  capabilities  for  space-based 
interceptors  at  a  later  date)  can  be  costly,  time-consuming,  and  disruptive. 
This  was  demonstrated  last  year  as  sdio  changed  its  program  focus  firom 
deterrence  to  protection,  requiring  a  year-long,  multi-million  dollar  study 
to  develop  new  system  and  bm/C3  architectures. 

BM/C3  is  the  most  important  and  least  understood  of  any  of  the  basic 
ballistic  missile  defense  functions  (sensing,  interception  and  destruction, 
and  BM/C3).  BM/C3  would  be  required  for  gpals,  or  any  missile  defense 
system,  to  perform  as  a  tightly  coordinated  imit — ^without  it,  sensors  and 
interceptors  would  be  useless.  The  bm/C3  architecture  describes  how  this 
coordination  would  occur,  and  serves  as  a  guide,  or  blueprint,  for 
developing  the  bm/C3  system.  Because  sdio  has  not  solidified  its 
architectures  and  also  distributed  bm/C3  responsibilities  among  developers, 
the  risk  increases  that  system  elements  will  be  incompatible. 

Distributing  BM/C3  responsibilities  among  developers  is  not,  in  and  of  itself, 
a  high-risk  approach  to  bm/c3  development.  However,  the  larger  and  more 
distributed  the  effort,  the  more  important  well-defined  system  and  bm/C3 
architectures  become.  Otherwise,  there  is  a  potential  for  wasted  efforts 
and  integration  problems.  Elqually  important,  without  a  stable  system  and 
BM/C3  architecture,  it  is  impossible  for  sdio  to  know  precisely  which 
supporting  technologies  will  be  required. 
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Further,  a  space-  and  ground-based  system  such  as  opals  faces  enormous 
technical  challenges.  Critical  yet  immature  bm/C3  software  and  hardware 
technologies  must  be  available  to  successfully  develop  and  integrate  such 
a  missile  defense  system.  To  mitigate  the  risk  of  committing  to  the 
development  of  the  system  before  these  technologies  are  sufficiently 
mature,  SDio  must  have  a  comprehensive  understanding  of  the  status  and 
interdependencies  among  all  technologies  and  precisely  what  role  each 
plays  along  the  critical  path  of  development. 


Because  of  the  design  and  cost  implications  of  including  or  excluding 
integration  capabilities  for  space-based  interceptors  in  the  missile  defense 
system,  we  recommend  that  the  Secretary  of  Defense  provide  the 
Congress  with  an  analysis  of  the  design  and  cost  implications  of 
(1)  including  integration  capabilities  for  space-based  interceptors  in  the 
architecture  but  never  deploying  them  and  (2)  excluding  such  integration 
capabilities  from  the  architecture  but  incorporatmg  space-based 
interceptors  later. 

Subsequently,  we  recommend  that  the  Secretary  of  Defense  develop  an 
implementation  plan  for  missile  defenses.  The  details  of  this  plan  should 
be  provided  with  Defense’s  next  appropriation  request  for  missile  defenses 
and  include,  but  not  be  limited  to, 

•  a  stable,  well-defined  missile  defense  system  architecture; 

•  a  well-defined,  integrated  bm/C3  architecture  sufficient  in  detail  to  provide 
the  guidance  and  direction  needed  by  developers  to  carry  out  their  bm/C3 
responsibilities;  and 

•  a  comprehensive  bm/C3  technology  plan  describing  reasonable  technology 
availability  schedules,  plans  for  insertion  of  improved  or  advanced 
technologies  as  they  become  available,  and  contingency  plans  for  dealing 
with  situations  when  technologies  are  not  available,  including  the 
ramifications  of  such  contingencies  on  system  performance. 


Recommendations  to 
the  Secretary  of 
Defense 


Agency  Comments 
and  Our  Evaluation 


The  Department  of  Defense  generally  concurred  with  our 
recommendation  to  the  Secretary  of  Defense  concerning  the  development 
of  an  implementation  plan  and  with  the  report’s  findings.  However,  it  did 
not  concur  with  our  depiction  of  the  complexity  of  the  gpais  system  and 
the  immaturity  of  some  needed  critical  technologies.  Defense  did  not  offer 
convincing  evidence  to  dispute  the  facts  presented  in  the  draft  report. 
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Additionally,  in  commenting  on  a  draft  of  this  report,  Defense  and  the 
Director  of  SDio  state  that  SDio  is  continuing  to  design  gpals  and  will 
include  integration  capabilities  for  space-based  interceptors  in  the  missile 
defense  system  described  in  the  Missile  Defense  Act  of  1991.  Because 
including  or  excluding  such  integration  capabilities  will  have  a  significant 
impact  on  system  design  and  cost,  we  redirected  the  draft  report’s 
recommendation  from  the  Congress  to  the  Secretary  of  Defense. 
Specifically,  we  recommend  that  the  Secretary  of  Defense  provide  the 
Congress  with  an  analysis  of  these  cost  and  design  implications. 


Evolution  of  the  Strategic  Defense  states  that  the  sm  program  objective  has  remained  fairly  constant, 
Defense  Initiative  F*rogram  ^  to  “direct  a  research  program  that  will  provide  the  basis  of  an 

informed  decision  regarding  the  feasibility  of  eliminating  the  threat  posed 
by  ballistic  missiles....”  While  this  broader  objective  may  not  have  changed, 
more  specific  objectives,  including  system  concepts,  designs,  and  missions 
have  undergone  msyor  change.  For  example,  the  original  concept  of 
defending  against  a  massive  Soviet  ballistic  missile  attack  was  changed  to 
deterring  such  an  attack,  and  now  to  protecting  against  limited  attacks 
originating  anywhere  in  the  world. 

In  1983  the  Strategic  Defense  Initiative  began  as  a  research  program  but 
transitioned  into  Defense’s  formal  acquisition  process  in  1987.  'This 
transition  required  SDio  to  develop  a  system  architecture.  Since  then,  sdio’s 
program  and  system  architecture  have  been  in  a  state  of  flux.  The  1987 
architecture  has  undergone  nuyor  revisions  because  of  changing  concepts, 
designs,  technologies,  and  mission  objectives.  For  example,  the 
introduction  of  Brilliant  Pebbles  in  late  1989  precipitated  change  requiring 
SDIO  to  spend  more  than  a  year  revising  the  system  architecture.  Before  the 
changes  resulting  from  Brilliant  Pebbles  were  completed.  President  Bush 
refocused  the  program  from  a  deterrence  to  a  protection  mission, 
requiring  more  time  to  reassess  and  redesign  the  system  architecture.  To 
accomplish  this,  a  study  was  initiated  in  Februaiy  1991,  and  sdio  has  yet  to 
complete  this  effort  If  SDi  had  remained  a  research  program  and  had  not 
entered  the  formal  acquisition  process,  the  impacts  of  changing  concepts, 
designs,  technologies,  and  objectives  would  have  been  far  less  disruptive 
and  costly. 


BM/C3  Development  According  to  SDIO,  BM/C3  development  is  being  suitably  addressed. 

Nevertheless,  the  lack  of  a  stable  architecture  causes  confusion.  While 
SDIO  has  been  reviewing  the  system  and  bm/C3  architectures,  developers 
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Technology  Challenges 


have  continued  to  work  on  their  components,  including  the  BM/C3 
requirements.  As  we  reported,  officials  at  two  Defense  organizations 
expressed  concern  over  proceeding  with  their  bm/C3  efforts  without  a 
well-defined  architecture. 

While  SDio  states  that  a  single  system  engineer  and  integration  contractor 
has  been  assigned  bm/C3  system-level  responsibilities,  this  alone  does  not 
mitigate  the  risk.  Until  the  architecture  is  solidified,  the  system  engineer 
and  integration  contractor  will  not  be  able  to  provide  the  system-level 
guidance  necessary  to  avoid  the  potential  problems  cited  by  Army  and  Air 
Force  officials. 


Defense  disagrees  with  our  depiction  of  the  complexity  of  gpals’  bm/C3 
subsystem  and  the  statement  that  significant  technological  challenges 
must  be  resolved  to  successfully  develop  gpals.  However,  Defense  did  not 
provide  convincing  evidence  to  dispute  the  facts  presented  in  the  draft 
report.  According  to  Defense,  it  is  working  to  minimize  the  complexity  of 
the  BM/C3  subsystem  for  gpals.  For  example.  Defense  states  that  the  bm/C3 
subsystem  is  being  designed  so  that  only  modest  amounts  of  data  will  be 
transferred  among  subsystems.  Defense  also  states  that  no  shared  data 
processing  or  distributed  data  base  concepts  will  be  involved  or  required. 
Whether  or  not  such  distributed  processing  concepts  are  used,  the  bm/C3 
subsystem  wiU  still  be  of  imprecedented  complexity,  gpals  may  be  more 
autonomous  and  may  have  to  contend  with  fewer  numbers  of  warheads 
than  previous  system  designs,  but  bm/C3  will  have  to  coordinate — ^in  real 
time — diverse  subsystems  widely  distributed  on  the  ground  and  in  space. 
Experts  in  the  field  said  that  there  are  mqjor  challenges  in  the  area  of 
real-time  distributed  processing.  In  fact,  the  official  from  the  National 
Security  Agency  who  completed  our  technology  maturity  matrix  stated 
that  many  of  the  parameters  of  real-time  distributed  processing  are  poorly 
understood,  at  best. 

Defense  states  that  there  is  little  basis  for  asserting  that  software  safety, 
correctness,  and  fault  tolerance  are  more  demanding  for  gpals  than  for 
nuclear  reactors,  medical  systems,  or  aircraft  flight  control  systems. 
Further,  Defense  noted  that  large  software  systems  can  and  do  operate 
reliably  with  minor  errors  or  weaknesses.  But  gpals  carmot  be  compared 
to  existing  systems.  The  consequences  of  an  operational  software  failure 
with  GPAis  could  be  catastrophic.  The  Patriot  missile  defense 
system — whose  supporting  software  is  much  smaller  and  far  less 
complex — failed  to  engage  an  incoming  missile  during  the  Persian  Gulf 
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resulting  in  the  deaths  of  28  Americans.  If  gpals  fails  to  engage,  millions  of 
people  could  be  killed. 

GPALS  will  involve  an  interconnection  of  sensors,  weapons, 
communications,  and  decision-making  subsystems.  Software  must  meet 
highly  stringent  requirements  for  security  and  safety  and  must  operate  in  a 
hostile  environment  These  critical  requirements  must  be  supported  by 
processes  and  technology  that  can  provide  high  levels  of  assurance  of 
correct  behavior.  The  need  for  such  software  processes  and  technologies, 
coupled  with  the  characteristics  of  the  gpals  architecture,  make  bm/C3 
software  for  gpals  a  formidable  challenge. 

Defense  also  states  that  it  has  many  trusted  and  secure  computing  and 
command  systems  that  gpals  can  use.  We  did  not  assert  otherwise. 
However,  according  to  Defense  dociunentation  and  statements  of  Defense 
officials,  gpals’  bm/C3  software  requires  a  level  of  trust  not  yet  achieved.  We 
collected  and  analyzed  data  from  officials  from  the  Army’s  Strategic 
Defense  Command,  fire  Defense  Advanced  Research  Agency,  the  National 
Security  Agency,  and  the  National  Institute  of  Standards  and  Technology 
that  all  corroborated  our  findings.  Defense  itself  has  initiated  a  Trusted 
Software  Program  to  address  critical  trust  issues  for  gpai^. 

Technology  Integration  Defense  states  that  a  transition  plan  and  technology  road  map  will  be  used 

and  that  technologies  are  sufficiently  mature  to  begin  developing  gpais 
BM/C3.  By  recommending  that  the  Secretary  of  Defense  develop  a  transition 
plan  and  technology  road  map,  we  are  not  implying  that  sdio  was  not 
intending  to  develop  them.  Further,  as  our  evidence  indicates,  some  of  the 
required  technologies  are  immature,  which  introduces  lislq  integrating 
such  technologies  into  a  coherent  system  compounds  this  risk.  Our 
concern  is  that  the  complexity,  cost,  and  technological  risks  associated 
with  this  system  are  unprecedented;  hence,  we  believe  comprehensive 
plans  need  to  be  developed  as  soon  as  possible  to  identify,  control,  and 
mitigate  these  risks. 
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Arrow  and  ACES:  A  theater  ballistic  missile  defense  interceptor  concept 
being  jointly  developed  with  the  Israeli  government.  ACES  is  a  follow-on 
to  the  Arrow,  with  a  defense  range  significantly  greater  than  the  Patriot. 

Brilliant  Eyes  (BE):  Space-based  satellite  sensors  for  surveillance, 
tracking,  and  discrimination  during  late  boost  and  midcourse  phases. 
Brilliant  Eyes  is  intended  to  support  space-and  ground-based  interceptors. 

Brilliant  Pebbles  (BP):  A  distributed,  autonomous,  space-based  interceptor 
and  sensor  system.  It  is  being  designed  to  collide  with  and  destroy  enemy 
missiles  during  the  early  phases  of  the  missiles’  flight.  Brilliant  Pebbles  is 
intended  to  intercept  any  ballistic  missile  above  the  earth’s  atmosphere 
with  a  range  in  excess  of  several  hundred  miles. 

Command  Center  Element  (CCE):  A  distributed  system  of  facilities, 
equipment,  communications,  personnel,  and  procedures  that  supports 
decision  making,  battle  planning,  and  execution  of  the  missile  defense 
mission. 

Endo-Exoatmospheric  Interceptor  (E2I):  A  U.S.  ground-based  interceptor 
that  uses  the  atmosphere  for  discrimination  of  warheads  from  deco}^;  £121 
can  also  intercept  in  late  midcourse  (i.e.,  can  intercept  both  inside  and 
outside  the  atmosphere). 

EIxtended  Range  Interceptor  (ERINT):  A  theater  missile  defense 
interceptor  that  works  with  the  Patriot  launch  system,  providing  greater 
firepower  and  destroying  targets  in  the  low  atmosphere  by  colliding  with 
them. 

Ground-based  Interceptor  (GBI):  A  U.S.  ground-based  interceptor 
designed  to  engage  warheads  outside  the  atmosphere  (exoatmosphere) 
during  midcourse. 

Ground-based  Radar-Terminal  (GBR-'T):  A  U.S.  ground-based  sensor  that 
provides  search,  tracking,  and  discrimination  capabilities  for  U.S. 
ground-based  interceptors.  TMD-GBR  is  the  theater  version  of  this  radar 
capability  and  will  support  theater  ground-based  interceptors. 

Ground  Surveillance  and  Tracking  System  (GSTS):  A  U.S.  ground-launched 
suborbital  rocket  surveillance  system  that  uses  sensors  to  perform 
tracking  and  discrimination  of  midcourse  objects. 
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Patriot  Preplanned  Product  Improvement  (P3I):  An  enhancement  to  the 
Patriot  missile  defense  system.  The  Patriot’s  velocity  will  be  increased;  the 
system  will  also  be  supported  by  a  more  sophisticated  fire  control  radar. 

Theater  High-Altitude  Area  Defense  (THAAD):  A  theater  ground-based 
interceptor  that  is  to  destroy  theater/tactical  ballistic  missiles  at  high 
altitudes.  THAAD  is  to  provide  a  large  area  defense  capability  and  support 
other  interceptors  such  as  Patiiot  and  ERINT. 
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DEPARTMENT  OF  DEFENSE 
STRATEGIC  DEFENSE  INITIATIVE  ORGANIZATION 
WASHINGTON.  DC  20301-7100 


January  17,  1992 


Mr.  Ralph  V.  Carlone 
Assistant.  Comptroller  General 
Information  Management  and 
Technology  Division 
U.S.  General  Accounting  Office 
Washington,  D.C.  20548 

Dear  Mr.  Carlone: 

This  is  the  Department  of  Defense  (DoD)  response  to  the 
General  Accounting  Office  (GAO)  draft  report,  entitled  "STRATEGIC 
DEFENSE  INITIATIVE:  Changing  Design  and  Technological 
Uncertainties  Create  Significant  Risk,"  dated  December  1991  ((3AO 
code  510620),  OSD  Case  8889.  The  Department  partially  concurs 
with  the  draft  report. 

The  original  mission  and  program  objective  of  the  Strategic 
Defense  Initiative  Organization  has  not  changed  since  its 
inception.  It  is  defined  in  the  DoD  Directive  as  "...direct  a 
research  program  that  will  provide  the  basis  of  an  informed 
decision  regarding  the  feasibility  of  eliminating  the  threat 
posed  by  ballistic  missiles...."  As  early  as  1984,  DoD  direction 
was,  "The  progr2un  shall  protect  U.S.  options  for  near-term 
deployment  of  limited  ballistic  missile  defenses."  In  1991,  in 
light  of  the  emerging  post  Cold  War  world,  the  program  was 
refocused  to  a  Global  Protection  Against  Limited  Strikes. 

Changes  to  the  overall  architecture  over  the  past  years  have  been 
in  response  to  changes  in  projected  threats  and  improving 
technology.  The  changes  ve  resulted  in  an  improved,  more 
affordable,  and  responsi  Strategic  Defense  System  architecture 
and  irogram. 

The  acquisition  strategy  of  the  Strategic  Defense  Initiative 
has  been  to  develop  ballistic  missile  defense  technology  as  it 
matures  and,  as  it  is  proven,  to  move  to  deploy  it  in  an 
evolutionary  manner.  Since  the  initiative  has  been  largely  a 
research  program,  many  different  technologiiis ,  many  different 
architectures,  and  many  different  program  responses  to  changes  in 
threats  and  national  needs  have  been  investigated. 

The  development,  testing,  and  deployment  strategy  for  a 
Global  Protection  Against  Limited  Strikes  follows  an  evolutionary 
and  integrated  approach.  It  is  evolutionary,  because  it 
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initially  develops  a  system  that  relies  on  proven  technology  and 
research  (the  initial  National  Missile  Defense  I  and  builds  upon 
it.  It  is  integrated,  because  from  the  onset,  the  OoD  has  been 
planning  for  an  architecture  that  will  maximize  a  Global 
Protection  Against  Limited  Strike  capability,  particularly  from 
the  Battle  Hanagement/Comnand ,  Control  and  Comnuni cat ions 
perspective . 

Battle  Management/Command ,  Control  and  Consnunications  have 
evolved  and  changed  with  the  system  architecture  design.  In 
fact,  changes  and  evolution  of  the  system  architecture  have 
clarified  and  simplified  Battle  Management/Camnand,  Control  and 
Consnunications.  The  goal  has  been  and  still  is  to  deploy 
practical,  demonstrable  ballistic  missile  defenses  in  a  phased  or 
segmented  approach,  with  the  ability  to  add  greater  capabilities 
and  systems  in  the  future.  That  means  that  Battle  Management/ 
Command,  Control  and  Consnunications  must  be  adaptable  and  updated 
to  technology  innovations  and  architectiural  design  changes. 

The  DoO  acquisition  policies  and  procedures  call  for  early 
identification  and  resolution  of  critical  risks.  Demonstration 
and  validation  is  the  phase  in  which  a  program  is  required  to 
demonstrate  critical  technologies.  The  selection  of  appropriate 
Battle  Management/Command,  Control  and  Consnunications 
technologies  on  which  to  proceed  will  be  reviewed  by  the 
Department,  before  beginning  the  engineering  and  manufacturing 
development  stage  (Milestone  II). 

The  detailed  DoD  consnents  on  the  report  findings, 
recommendation,  and  matter  for  Congressional  consideration  are 
provided  in  the  enclosure.  The  Department  appreciates  the 
opportunity  to  consnent  on  the  draft  report. 


Enclosure : 
As  Stated 
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GAO  DBAFT  EEPOBT  -  DATED  DECEMBER  24,  1991 
(GAO  CODE  510620)  OSD  CASE  8889 

'STRATEGIC  DEFENSE  INITIATIVE:  CHANGING  DESIGN  AND 
TECHNOLOGICAL  UNCERTAINTIES  CREATE  SIGNIFICANT  BISK* 

FINDINGS,  BECOtMENDATION,  AND  MATTER  FOR  GCRIGBESSIONAL 

OXiSIDEBATICRI 

DEPARTMENT  OF  DEFENSE  (ORMENTS 


FINDINGS 


o  FINDING  A;  Evolution  of  the  Strategic  Defense  Initiative 
Procrram.  The  GAO  reported  that,  although  the  Strategic 
Defense  Initiative  was  originally  conceived  as  a  defense 
against  a  massive  Soviet  missile  attack,  the  current  version 
of  the  system  is  intended  to  defend  the  U.S.  and  its  allies 
against  a  limited  ballistic  missile  attack  from  any  country 
in  the  world.  The  GAO  found  that  change  has  been  a  constant 
element  of  the  Strategic  Defense  Initiative  since  1983.  For 
example,  the  GAO  reported  that,  in  July  1990,  the  system 
then  known  as  Phase  I,  was  in  a  state  of  flux,  primarily 
because  Brilliant  Pebbles  was  added  to  the  architecture, 
causing  a  major  restructuring.  The  GAO  indicated  the  DoD  is 
currently  advocating  a  system  that  integrates  ground-based 
defenses  with  space-based  interceptors,  and  would  like  the 
system  deployed  by  the  year  2000.  The  GAO  noted,  however, 
that  the  Missile  Defense  Act  of  1991,  which  is  the  first 
bipartisan  consensus  on  missile  defenses  since  the  debate 
began  25  years  ago,  establishes  goals  based  on  ground-based 
interceptors,  accelerates  development  of  missile  defense 
systems,  and  authorizes  $465  million  for  research  and 
development  of  space-based  interceptors,  even  though  the  Act 
excludes  space-based  interceptors  from  the  architecture. 

The  GAO  also  reported  that  the  President's  FY  1992  budget 
estimates  the  acquisition  cost  at  $41  billion  (in  1988 
dollars).  (pp-  2-3,  pp.  10-19/GAO  Draft  Report) 

DoD  RESPONSE;  Partially  concur.  The  overall  objective  of 
the  program  has  remained  fairly  constant,  with  near  term 
deployment  of  limited  ballistic  missile  defenses  envisioned. 
The  Strategic  Defense  Initiative  Program  has  adjusted  both 
to  the  changing  geopolitical  situation  and  advances  in 
ballistic  missile  defense  technology.  The  research  and 
development  strategy  throughout  the  life  of  the  program  has 
been'..to  improve  the  performance  and  autonomy  of  the  system 
elements  associated  with  ballistic  missile  defense,  while 
reducing  the  cost  and  complexity.  At  the  same  time,  the 
Strategic  Defense  Initiative  Organization  is  conducting 
research  into  new  promising  systems  and  technologies. 
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The  GAO  example  of  the  Brilliant  Pebbles  addition  placing 
the  system  architecture  in  a  ’state  of  flux*  is  not 
accurate.  Brilliant  Pebbles  combines  the  functions  of 
ballistic  missile  detection,  tracking  and  interception  into 
a  single  space-based  element.  The  introduction  of  Brilliant 
Pebbles  simplified  the  design  of  the  initial  architecture 
while  retaining  its  functionality  by  eliminating  the 
dependence  of  space-based  weapons  on  a  Boost  Surveillance 
and  Tracking  System.  In  addition,  it  significantly  reduced 
the  costs  of  a  Strategic  Defense  System.  As  promising 
concepts  such  as  Brilliant  Pebbles  are  identified,  changes 
in  the  design  of  the  Strategic  Defense  System  have  been 
made.  The  purpose  of  these  changes  is  to  provide  a  more 
effective,  affordable,  and  survivable  defense  against 
ballistic  missiles. 


o  PIHDING  B;  The  Congress  and  the  DoD  Differ  on  Inclusion  of 
Space-based  Interceptors.  The  GAO  reported  that  the 
Strategic  Defense  Initiative  has  had  to  accoinnodate  shifting 
International  threats,  changing  concepts  and  designs,  and 
continuing  debate  between  the  Administration  and  the 
Congress  on  the  program  mission  and  objectives,  — and,  that 
absent  agreement,  the  DoD  has  pursued  several  different 
approaches  consuming  billions  of  dollars  along  the  way. 

The  GAO  found  that,  for  the  past  year,  the  DoD  has  been 
pressing  forward  with  a  missile  defense  system,  referred  to 
as  Global  Protection  Against  Limited  Strikes,  consisting  of 
a  National  and  Theater-based  segments  and  one  space-based 
segment.  The  GAO  noted  that  each  of  the  segments  would  have 
its  own  sensors  and  interceptors  and  could  operate 
independently;  however,  the  GAO  indicated  it  is  the  DoD  view 
that  all  three  must  be  integrated  to  provide  mutual, 
coordinated  support — an  approach  that  requires  the  segments 
to  work  together,  using  automated  data  processing  and 
communication  networks. 

The  GAO  reported  that  the  Congress  and  the  DoD  differ  on  how* 
to  provide  the  most  effective  defense.  The  GAO  found  that, 
while  the  Act  supports  deployment  of  ground-based  defenses, 
it  excludes  space-based  interceptors  from  the  system 
architecture,  but  leaves  the  option  open  to  include  them 
later.  The  GAO  indicated  that,  if  the  Congress  subsequently 
agrees  with  Defense  that  space-based  interceptors  should  be 
Included,  significant  re-engineering  will  be  required  to 
include  them  in  the  system  and  Battle  Management/Command, 
Control  and  Communications  architectures.  Further,  the  GAO 
pointed  out  that,  without  a  stable  system  and  architecture, 
the  risk  that  the  system  will  not  work  as  intended  increases 
greatly.  The  GAO  concluded  that  adding  space-based 
interceptors  at  a  later  date  would  have  a  significant  Impact 
on  the  ground-based  system — potentially  costing  hundreds  of 
millions  of  dollars.  (pp.  23-25/GAO  Draft  Report) 
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DoD  BESPONSE:  Partially  concur.  The  Global  Protection 
Against  Limited  Strikes  concept  represents  an  orderly 
evolution  from  the  previous  Phase  I  Strategic  Defense 
System.  The  Global  Protection  Against  Limited  Strikes 
objective  is  protection  from  limited  strikes,  rather  than 
the  Phase  I  concept  of  deterring  massive,  deliberate  attacks 
by  the  Soviet  Union.  Protection  against  limited  strikes  was 
a  sub-goal  of  the  previous  Phase  I  system. 

As  previously  noted,  the  instability  (to  which  the  GAO  has 
alluded)  relates  to  evolvable  changes  to  improve  the 
effectiveness  and  cost  of  a  Strategic  Defense  System 
throughout  its  development.  Battle  Management /Command, 

Control  and  Conmuni cat ions  is  not  simply  driven  by 
individual  sensor  and  weapon  technology;  rather,  it  is  a 
critical  architectural  function  which  all  segments  must  rely 
on.  The  greatest  risk  of  failure  is  to  not  address 
adequately  Battle  Management/Command,  Control  and 
Communications  capabilities  and  trade-offs  as  part  of  a  long 
range  plan.  The  Global  Protection  Against  Limited  Strikes 
is  establishing  a  Battle  Management /Conmand,  Control  and 
Communications  structure  that  supports  all  system  segments 
whenever  they  are  incorporated  into  the  system  architecture. 

The  Department  supports  the  Missile  Defense  Act  of  1991. 

The  Global  Protection  Against  Limited  Strikes  is  a  system 
that  allows  for  segmented  growth,  as  required,  and  is 
designed  to  evolve  as  threats  and  national  requirements 
change.  Space  sensors  play  key  roles  in  both  national  and 
theater  segments.  Space-based  interceptors  also  have 
important  roles,  especially  for  longer  range  missiles.  The 
system  design  is  specifically  intended  to  be  flexible  and 
may  incorporate  a  space-based  segment  as  national  decision 
makers  may  decide.  The  National  Defense  Segment  or  Theater 
Defense  Segment  will  not  have  to  be  redesigned  for  a  space- 
based  segment.  In  addition,  there  is  no  significant  cost 
impact  of  "hundreds  of  millions  of  dollars*  in 
re-engineering  costs  to  add  a  space-based  segment  at  a  later' 
date.  Indeed,  with  appropriate  planning  (and  depending  on  when 
space-based  interceptors  are  added),  there  may  be  substantial 
reductions  in  the  cost  of  providing  a  given  desired  level  of 
protection  and  coverage. 


FINDING  C;  Oianqes  in  Architecture  Significantly  Hinder 
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September  1991,  will  not  be  completed  until  early  1992.  The 
GAO  also  found  that  the  DoO  is  still  considering  many 
different  sensor  and  interceptor  combinations  for  Global 
Protection  Against  Limited  Strikes,  and  that  the  Battle 
Management/Connand,  Control  and  Comnunications  architecture, 
which  has  not  been  solidified,  has  been  distributed  among 
several  contractors  for  research  and  development,  thereby 
exacerbating  the  risk  of  system  incompatibility  and 
duplication  of  efforts.  (pp.  25-28/GAO  Draft  Report) 

DoD  HESPOWSE:  Partially  concur.  While  the  DoD  continues  to 
perform  Strategic  Defense  System  studies.  Battle 
Management/Command,  Control  and  Cosniunications  development 
is  being  suitably  addressed.  Battle  Management/Comnand, 
Control  and  Conanunications  planning  and  evolution  have 
proceeded  vigorously  as  an  integral  part  of  the  overall 
system  architectural  evolution.  Changes  and  evolution  of 
the  system  architecture  have  clarified  and  simplified  Battle 
Management/Comnand,  Control  and  Communications  concepts,  and 
have  been  incorporated  after  ample  system  testing. 

The  Architecture  Integration  study  was  created  to  analyze 
and  evaluate  architectures  to  protect  against  limited 
strikes,  define  defense  mission  and  goals  and  architecture 
variations  for  alternative  futures,  provide  a  rationale  and 
road  map  for  the  architectures,  and  identify  interactions 
and  interfaces  with  other  elements  of  U.S.  and  allied 
security  policies.  The  first  phase  of  the  study  was 
completed  in  September  1991,  and  it  was  extended  to  perform 
cost  and  operational  effectiveness  analyses;  particularly  to 
account  for  the  Missile  Defense  Act  of  1991. 

In  addition,  the  Strategic  Defense  Initiative  Organization 
assigned  to  a  single  System  Engineer  and  Integration 
Contractor  the  responsibility  to  produce  controlled, 
integral  top-level  building  block  designs  to  integrate 
segments  without  a  duplication  of  effort  into  a  Global 
Protection  Against  Limited  Strikes  system.  Thus,  Battle 
Management/Command,  Control  and  Communications  is  being 
designed  at  the  system  level  and  not  the  segment  or  element 
level.  That  approach  is  aimed  at  reducing  the  risk  of 
system  incompatibility  and  duplication  of  efforts. 


o  PINDIWG  Ds  Resolving  Technolotrv  Oiallenges  Is  Essential  To 
Successful  Global  Protection  Against  Limited  Strikes 
Development .  The  GAO  reported  that  the  complexity  of  the 
Battle  Management/Coiranand,  Control  and  Communications  system 
for  Global  Protection  Against  Limited  Strikes  is 
unprecedented.  The  GAO  explained  that  the  system  will  have 
to  operate  in  real  time  in  a  hostile  environment  in  a 
constantly  changing  configuration.  The  GAO  found  that  ID 
the  Battle  Management/Command,  Control  and  Comnunications 
functions  must  be  distributed  among  hundreds  of  computers 
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located  in  space  and  throughout  the  world,  (2)  some 
computers  will  probably  require  advanced  parallel  processing 
designs,  and  (31  many  processors  will  require  information 
from  multiple  data  bases,  thereby  introducing  the  need  for 
distributed  data  base  management.  In  response  to  those 
challenges,  the  GAO  noted  that  the  DoD  has  identified 
critical  advances  in  software  and  hardware  technology 
required  to  implement  the  system,  such  as  trusted  software, 
software  for  parallel  processors,  tools  and  techniques  for 
effective  software  engineering,  space- to— space 
communications,  and  parallel  processing  for  ballistic 
missile  defense. 

The  GAO  found  that  the  required  technologies  are  all  objects 
of  current  research  and  none  is  yet  sufficiently  mature  to 
support  the  Global  Protection  Against  Limited  Strikes  Battle 
Management/Command,  Control  and  Communications  system.  The 
GAO  explained  that  the  software  will  require  a  level  of 
trust  never  before  achieved;  i.e.,  it  may  have  to  operate  on 
parallel  processors  and  it  will  require  a  highly 
sophisticated  software  engineering  and  development 
environment  that  is  not  currently  available.  The  GAO 
indicated  that  state-of-the-art  practice  generally  lags  well 
behind  the  technology  state-of-the-art;  therefore,  it  will 
be  some  time  before  the  technology  is  proven  well  enough  to 
be  conmercially  available.  The  GAO  also  found  that  hardware 
technologies  appear  to  be  advancing  fairly  rapidly  and  that 
parallel  processing  hardware  has  been  available  for  years. 
The  GAO  concluded,  however,  that  implementing  parallel 
processors  on  board  small,  lightweight  spacecraft  will 
involve  packaging  challenges  to  meet  size,  weight,  and  power 
constraints.  (pp-  29-36 /GAO  Draft  Beport) 

DoD  RESPOHSE:  Nonconcur.  The  GAO  states  that  the  Battle 
Management/Command,  Control  and  Communications  system  has 
’unprecedented  complexity,*  that  ’enormous  amounts  of 
information  will  have  to  be  processed  and  shared  —  possibly 
among  hundreds  —  of  different  computers*  and  that  a 
’distributed  data  base  is  essential.*  The  GAO  further 
states  that  the  Battle  Management/Connand .  Control  and 
Communications  software  ’...is  the  most  complex  and 
difficult  of  any  military  or  civilian  software  developed  and 
implemented  to  date.* 

The  Strategic  Defense  Initiative  Organization  is  designing 
the  Battle  Management/Command,  Control  and  Communications 
system  for  data  processing  simplicity,  such  that  only  modest 
amounts  of  data  are  transferred  to  coordinate  and  control 
Global  Protection  Against  Limited  Strikes  elements.  The 
information  handled  by  each  computer  is  tightly  constrained, 
as  is  its  functionality  in  the  system.  Although  data  exists 
in  multiple  locations  for  redundancy  and  robustness,  during 
operation  no  shared  data  processing  or  distributed  data  base 
concepts  are  involved  or  required. 
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There  is  little  basis  for  asserting  that  software  safety, 
correctness,  and  fault  tolerance  are  more  demanding  for  a 
Global  Protection  Against  Limited  Strikes  than  for  nuclear 
reactors,  medical  systems,  or  aircraft  flight  control 
systems.  Large  software  systems  can  and  do  operate  reliably 
with  minor  errors  or  weaknesses.  The  trusted  operating 
system  and  trusted  data  base  system  under  research  by  the 
National  Seciurity  Agency  and  the  Defense  Advanced  Besearch 
Projects  Agency  represent  work  to  explore  new  concepts  and 
implementation  methods  that  could  provide  general 
capabilities.  Success  of  a  trusted  system  does  not  depend 
on  having  mature  and  general  solutions.  The  DoD  already  has 
many  trusted  and  secure  computing  systems  and  command 
centers  and  the  Global  Protection  Against  Limited  Strikes 
system  will  utilize  proven  existing  systems  enhanced  by 
applicable  technologies  emerging  from  current  research. 


o  FINDING  E;  Integration  of  Required  Ismature  Technologies 

Greatly  Exacerbates  Existing  Complexities.  The  GAO  reported 
that  individual  technologies  alone  cannot  support  Global 
Protection  Against  Limited  Strikes  Battle  Management/ 
Command,  Control  and  Communications,  and  that  the  Strategic 
Defense  Initiative  Organization  will  be  faced  with  the 
enormous  challenge  of  integrating  the  technologies  to 
provide  the  data  processing  and  communications  capabilities 
needed.  The  GAO  explained  that  the  difficulty  lies  not  only 
in  the  integration  task  itself,  but  also  in  the  lack  of 
experience  with  individual  technologies,  compounded  by  a 
lack  of  understanding  of  the  interactions  among  them.  The 
GAO  further  explained  that,  besides  the  complexity  of  the 
interactions  of  the  technologies,  tradeoffs  must  also  be 
made.  The  GAO  concluded  that  prematurely  comnitting  to 
inadequate  existing  technologies,  or  depending  on  the  future 
success  of  currently  innature  or  unavailable  technologies, 
increases  the  risk  that  Global  Protection  Against  Limited 
Strikes  will  not  work  as  intended,  or  will  not  be  able  to 
easily  evolve.  The  GAO  further  concluded  that  (1)  a 
technology  road  map  that  defines  what  technologies  are 
needed  and  when,  and  what  the  interdependencies  are,  is 
essential,  and  (2)  plans  for  transitioning  from  existing  to 
emerging  technologies,  inserting  technologies  as  they  become 
available,  and  for  contingencies  if  a  technology  is  not 
ready,  are  also  needed.  (pp.  37-38/GAO  Draft  Beport) 

DoD  BESPONSE;  Partially  concur.  A  transition  plan  and 
technology  road  map  will  be  utilized.  As  previously  stated, 
current  mature  technologies  are  sufficient  to  begin 
developing  a  Battle  Management/Command,  Control  and 
Communications  system  for  a  Global  Protection  Against 
Limited  Strikes.  The  DoD  continues  to  pursue  research  and 
development  in  order  to  improve  solutions  that  may  be 
needed . 


Page  47 


GAO/IMTEC-92-18  SDl  Development  Risk 


Appendix  II 

Comments  From  the  Depsrtment  of  Defense 


«  ft  A  1%  * 

BECOMMENDATION 

O  BECOflEWDATION  1 :  Because  of  -technological  uncertainties, 

the  GAO  recommended  -that  -the  Secretary  of  Defense  develop  an 
implementation  plan  for  ballistic  missile  defenses.  The  GAO 
further  recommended  that  -the  details  of  the  plan  be  provided 
with  the  next  DoD  appropriation  request  for  missile  defenses 
and  include,  but  not  be  limited  to: 

—  a  stable,  well-defined  ballistic  missile  defense 
system  architecture: 

—  a  well-defined,  integrated  Battle  Management/ 

Command,  Control  and  Communications  architecture, 
sufficient  in  detail  to  provide  the  guidance  and 
direction  needed  by  developers  to  carry  out  their 
responsibilities;  and 

—  A  comprehensive  Battle  Management/Command ,  Control 
and  Communications  technology  plan  describing 
reasonable  technology  availability  schedules, 
plans  for  insertion  of  improved  or  advanced 
technologies  as  they  become  available,  and 
contingency  plans  for  dealing  with  situations  when 
technologies  are  not  available,  including  -the 
ramifications  of  such  contingencies  on  system 
performance.  (p.  41 /GAO  Draft  Report) 

DoD  HESPOWSE:  Partially  concur.  The  Department  agrees  that 
the  described  information  should  be  provided  to  -the 
Congress,  but  does  not  agree  a  separata  plan  is  necessary. 
Instead,  the  DoD  will  provide  the  information  as  part  of  the 
President's  FY  1993  budget,  the  Report  to  Congress  on  the 
Strategic  Defense  Initiative,  and  such  other  congressional 
submissions,  as  required.  The  Department  is  conmitted  to 
providing  the  Congress  all  the  information  necessary  for  a 
complete  and  thorough  review  of  the  Global  Protection 
Against  Limited  Strikes  program. 


MATTER  FOR  CONGRESSIONAL  CONSIDERATION 

o  mATI'ER  1  :  Since  the  Congress  has  left  -the  option  open  for 
space-based  interceptors,  the  GAO  recommended  that  the 
Congress  authorise  the  DoD  to  include  space-based 
Interceptors  in  the  missile  defense  system  architecture  to 
minimize  risks  and  the  need  for  potential  re-engineering, 
(pp.  40-41 /GAO  Draft  Report) 
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DoD  HESPCTfSE;  Concur.  Space-based  inbercep'tors  allow  Cor  a 
continuous  global  capability  in  ballistic  missile  defense. 

In  concert  with  surf ace— based  defense  deployed  nationally  or 
in  theaters  of  operation,  it  would  assure  high-confidence 
protection  against  limited  ballistic  missile  strikes. 
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